Module: Padrino::Helpers::FormHelpers::Security

### Home Classes Methods

### In Files

- lib/padrino-helpers/form_helpers/security.rb

### Methods

- #csrf_meta_tags
- #csrf_param
- #csrf_token
- #csrf_token_field
- #is_protected_from_csrf?

### Files

- README.rdoc

### Class/Module Index

Quicksearch

- Padrino
- Padrino::Helpers
- Padrino::Helpers::AssetTagHelpers
- Padrino::Helpers::FormBuilder
- Padrino::Helpers::FormBuilder::AbstractFormBuilder
- Padrino::Helpers::FormBuilder::DeprecatedBuilderMethods
- Padrino::Helpers::FormBuilder::StandardFormBuilder
- Padrino::Helpers::FormHelpers
- Padrino::Helpers::FormHelpers::Errors
- Padrino::Helpers::FormHelpers::Options
- Padrino::Helpers::FormHelpers::Security
- Padrino::Helpers::NumberHelpers
- Padrino::Helpers::OutputHelpers
- Padrino::Helpers::OutputHelpers::AbstractHandler
- Padrino::Helpers::OutputHelpers::ErbHandler
- Padrino::Helpers::OutputHelpers::HamlHandler
- Padrino::Helpers::OutputHelpers::SinatraCurrentEngine
- Padrino::Helpers::OutputHelpers::SlimHandler
- Padrino::Helpers::RenderHelpers
- Padrino::Helpers::TagHelpers
- Padrino::Helpers::TranslationHelpers
- Padrino::Rendering
- Padrino::Rendering::ClassMethods
- Padrino::Rendering::ErubisTemplate
- Padrino::Rendering::HamlTemplate
- Padrino::Rendering::InstanceMethods
- Padrino::Rendering::SafeBufferEnhancer
- Padrino::Rendering::SafeEruby
- Padrino::Rendering::SafeTemplate
- Padrino::Rendering::SlimTemplate
- Padrino::Rendering::TemplateNotFound
- Haml
- Haml::Helpers
- Haml::Util

No matching classes.

# Padrino::Helpers::FormHelpers::Security

Helpers to generate form security tags for csrf protection.

### Public Instance Methods

csrf_meta_tags() click to toggle source

Constructs meta tags `csrf-param` and `csrf-token` with the name of the cross-site request forgery protection parameter and token, respectively.

@return [String] The meta tags with the CSRF token and the param your app expects it in.

@example

    csrf_meta_tags

    # File lib/padrino-helpers/form_helpers/security.rb, line 34
    def csrf_meta_tags
      if is_protected_from_csrf?
        meta_tag(csrf_param, :name => 'csrf-param') <<
        meta_tag(csrf_token, :name => 'csrf-token')
      end
    end

csrf_token_field() click to toggle source

Constructs a hidden field containing a CSRF token.

@param [String] token

    The token to use. Will be read from the session by default.

@return [String] The hidden field with CSRF token as value.

@example

    csrf_token_field

    # File lib/padrino-helpers/form_helpers/security.rb, line 21
    def csrf_token_field
      hidden_field_tag csrf_param, :value => csrf_token
    end

### Protected Instance Methods

csrf_param() click to toggle source

Returns the param/field name in which your CSRF token should be expected by your controllers. Defaults to `authenticity_token`.

Set this in your application with `set :csrf_param, :something_else`.

    # File lib/padrino-helpers/form_helpers/security.rb, line 64
    def csrf_param
      defined?(settings) && settings.respond_to?(:csrf_param) ? settings.csrf_param : :authenticity_token
    end

csrf_token() click to toggle source

Returns the current CSRF token (based on the session). If it doesn't exist, it will create one and assign it to the session's `csrf` key.

    # File lib/padrino-helpers/form_helpers/security.rb, line 54
    def csrf_token
      session[:csrf] ||= SecureRandom.hex(32) if defined?(session)
    end

is_protected_from_csrf?() click to toggle source

Returns whether the application is being protected from CSRF. Defaults to true.

    # File lib/padrino-helpers/form_helpers/security.rb, line 46
    def is_protected_from_csrf?
      defined?(settings) ? settings.protect_from_csrf : true
    end

[Validate]

Generated with the Darkfish Rdoc Generator 2.