Class: Rack::Protection::FormToken

### Home Classes Methods

### In Files

- lib/rack/protection/form_token.rb

### Parent

Rack::Protection::AuthenticityToken

### Methods

- #accepts?

### Class/Module Index

Quicksearch

- Rack
- Rack::Protection
- Rack::Protection::AuthenticityToken
- Rack::Protection::Base
- Rack::Protection::EscapedParams
- Rack::Protection::FormToken
- Rack::Protection::FrameOptions
- Rack::Protection::HttpOrigin
- Rack::Protection::IPSpoofing
- Rack::Protection::JsonCsrf
- Rack::Protection::PathTraversal
- Rack::Protection::RemoteReferrer
- Rack::Protection::RemoteToken
- Rack::Protection::SessionHijacking
- Rack::Protection::VERSION
- Rack::Protection::XSSHeader

No matching classes.

# Rack::Protection::FormToken

Prevented attack | CSRF
Supported browsers | all
More infos | en.wikipedia.org/wiki/Cross-site_request_forgery

Only accepts submitted forms if a given access token matches the token included in the session. Does not expect such a token from Ajax request.

This middleware is not used when using the Rack::Protection collection, since it might be a security issue, depending on your application

Compatible with Rails and rack-csrf.

### Public Instance Methods

accepts?(env) click to toggle source

    # File lib/rack/protection/form_token.rb, line 18
    def accepts?(env)
      env["HTTP_X_REQUESTED_WITH"] == "XMLHttpRequest" or super
    end

[Validate]

Generated with the Darkfish Rdoc Generator 2.