Module: ActionView::Helpers::CsrfHelper
Relationships & Source Files | |
Extension / Inclusion / Inheritance Descendants | |
Included In:
ActionDispatch::DebugView,
::ActionView::Base ,
::ActionView::Helpers ,
::ActionView::TestCase ,
::ActionView::TestCase::Behavior
| |
Defined in: | actionview/lib/action_view/helpers/csrf_helper.rb |
Overview
Action View CSRF Helpers
Instance Method Summary
-
#csrf_meta_tag
Alias for #csrf_meta_tags.
-
#csrf_meta_tags
(also: #csrf_meta_tag)
Returns meta tags “csrf-param” and “csrf-token” with the name of the cross-site request forgery protection parameter and token, respectively.
Instance Method Details
#csrf_meta_tag
Alias for #csrf_meta_tags.
# File 'actionview/lib/action_view/helpers/csrf_helper.rb', line 32
alias
#csrf_meta_tags Also known as: #csrf_meta_tag
Returns meta tags “csrf-param” and “csrf-token” with the name of the cross-site request forgery protection parameter and token, respectively.
<head>
<%= csrf_meta_tags %>
</head>
These are used to generate the dynamic forms that implement non-remote links with :method
.
You don’t need to use these tags for regular forms as they generate their own hidden fields.
For Ajax requests other than GETs, extract the “csrf-token” from the meta-tag and send as the X-CSRF-Token
HTTP header. If you are using rails-ujs, this happens automatically.
# File 'actionview/lib/action_view/helpers/csrf_helper.rb', line 22
def if defined?(protect_against_forgery?) && protect_against_forgery? [ tag("meta", name: "csrf-param", content: request_forgery_protection_token), tag("meta", name: "csrf-token", content: form_authenticity_token) ].join("\n").html_safe end end