Module: ActionController::RequestForgeryProtection
Relationships & Source Files | |
Namespace Children | |
Modules:
| |
Classes:
| |
Extension / Inclusion / Inheritance Descendants | |
Included In:
| |
Super Chains via Extension / Inclusion / Inheritance | |
Class Chain:
|
|
Instance Chain:
|
|
Defined in: | actionpack/lib/action_controller/metal/request_forgery_protection.rb |
Overview
Controller actions are protected from Cross-Site Request Forgery (CSRF) attacks by including a token in the rendered HTML for your application. This token is stored as a random string in the session, to which an attacker does not have access. When a request reaches your application, ::Rails
verifies the received token with the token in the session. All requests are checked except GET requests as these should be idempotent. Keep in mind that all session-oriented requests are CSRF protected by default, including JavaScript and HTML requests.
Since HTML and JavaScript requests are typically made from the browser, we need to ensure to verify request authenticity for the web browser. We can use session-oriented authentication for these types of requests, by using the protect_from_forgery
method in our controllers.
GET requests are not protected since they don’t have side effects like writing to the database and don’t leak sensitive information. JavaScript requests are an exception: a third-party site can use a <script> tag to reference a JavaScript URL on your site. When your JavaScript response loads on their site, it executes. With carefully crafted JavaScript on their end, sensitive data in your JavaScript response may be extracted. To prevent this, only XmlHttpRequest (known as XHR or Ajax) requests are allowed to make requests for JavaScript responses.
Subclasses of Base
are protected by default with the :exception
strategy, which raises an InvalidAuthenticityToken
error on unverified requests.
APIs may want to disable this behavior since they are typically designed to be state-less: that is, the request API
client handles the session instead of ::Rails
. One way to achieve this is to use the :null_session
strategy instead, which allows unverified requests to be handled, but with an empty session:
class ApplicationController < ActionController::Base
protect_from_forgery with: :null_session
end
Note that API
only applications don’t include this module or a session middleware by default, and so don’t require CSRF protection to be configured.
The token parameter is named authenticity_token
by default. The name and value of this token must be added to every layout that renders forms by including csrf_meta_tags
in the HTML head
.
Learn more about CSRF attacks and securing your application in the [Ruby on ::Rails
Security Guide](guides.rubyonrails.org/security.html).
Constant Summary
-
AUTHENTICITY_TOKEN_LENGTH =
# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 45232
-
CROSS_ORIGIN_JAVASCRIPT_WARNING =
private
# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 417"Security warning: an embedded " \ "<script> tag on another site requested protected JavaScript. " \ "If you know what you're doing, go ahead and disable forgery " \ "protection on this action to permit cross-origin JavaScript embedding."
-
CSRF_TOKEN =
# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 64"action_controller.csrf_token"
-
GLOBAL_CSRF_TOKEN_IDENTIFIER =
private
# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 578"!real_csrf_token"
-
NULL_ORIGIN_MESSAGE =
# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 614<<~MSG The browser returned a 'null' origin for a request with origin-based forgery protection turned on. This usually means you have the 'no-referrer' Referrer-Policy header enabled, or that the request came from a site that refused to give its origin. This makes it impossible for Rails to verify the source of the requests. Likely the best solution is to change your referrer policy to something less strict like same-origin or strict-origin. If you cannot change the referrer policy, you can disable origin checking with the Rails.application.config.action_controller.forgery_protection_origin_check setting. MSG
::ActiveSupport::Callbacks
- Included
::AbstractController::Callbacks
- Attributes & Methods
- .raise_on_missing_callback_actions (also: #raise_on_missing_callback_actions) rw
- #raise_on_missing_callback_actions rw
::AbstractController::Helpers
- Attributes & Methods
Class Method Summary
::ActiveSupport::DescendantsTracker
- self
::ActiveSupport::Concern
- Extended
class_methods | Define class methods from given block. |
included | Evaluate given block in context of base class, so that you can write class macros here. |
prepended | Evaluate given block in context of base class, so that you can write class macros here. |
append_features, prepend_features |
Instance Attribute Summary
-
#any_authenticity_token_valid? ⇒ Boolean
readonly
private
Checks if any of the authenticity tokens from the request are valid.
-
#marked_for_same_origin_verification? ⇒ Boolean
readonly
private
If the #verify_authenticity_token before_action ran, verify that JavaScript responses are only served to same-origin GET requests.
-
#non_xhr_javascript_response? ⇒ Boolean
readonly
private
Check for cross-origin JavaScript responses.
-
#protect_against_forgery? ⇒ Boolean
readonly
private
Checks if the controller allows forgery protection.
-
#valid_request_origin? ⇒ Boolean
readonly
private
Checks if the request originated from the same origin by looking at the Origin header.
-
#verified_request? ⇒ Boolean
readonly
private
Returns true or false if a request is verified.
::AbstractController::Callbacks
- Included
Instance Method Summary
- #commit_csrf_token(request)
- #initialize
- #reset_csrf_token(request)
- #compare_with_global_token(token, session = nil) private
- #compare_with_real_token(token, session = nil) private
- #csrf_token_hmac(session, identifier) private
- #decode_csrf_token(encoded_csrf_token) private
- #encode_csrf_token(csrf_token) private
-
#form_authenticity_param
private
The form’s authenticity parameter.
-
#form_authenticity_token(form_options: {})
private
Creates the authenticity token for the current request.
- #generate_csrf_token private
- #global_csrf_token(session = nil) private
- #handle_unverified_request private
-
#mark_for_same_origin_verification!
private
GET requests are checked for cross-origin JavaScript after rendering.
- #mask_token(raw_token) private
-
#masked_authenticity_token(form_options: {})
private
Creates a masked version of the authenticity token that varies on each request.
- #normalize_action_path(action_path) private
- #normalize_relative_action_path(rel_action_path) private
- #per_form_csrf_token(session, action_path, method) private
- #real_csrf_token(_session = nil) private
-
#request_authenticity_tokens
private
Possible authenticity tokens sent in the request.
- #unmask_token(masked_token) private
- #unverified_request_warning_message private
-
#valid_authenticity_token?(session, encoded_masked_token) ⇒ Boolean
private
Checks the client’s masked token to see if it matches the session token.
- #valid_per_form_csrf_token?(token, session = nil) ⇒ Boolean private
-
#verify_authenticity_token
private
The actual before_action that is used to verify the CSRF token.
-
#verify_same_origin_request
private
If #verify_authenticity_token was run (indicating that we have forgery protection enabled for this request) then also verify that we aren’t serving an unauthorized cross-origin response.
- #xor_byte_strings(s1, s2) private
::AbstractController::Callbacks
- Included
#process_action | Override AbstractController::Base#process_action to run the |
::ActiveSupport::Callbacks
- Included
#run_callbacks | Runs the callbacks for the given event. |
#halted_callback_hook | A hook invoked every time a before callback is halted. |
::AbstractController::Helpers
- Included
DSL Calls
included
[ GitHub ]71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104
# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 71
included do # Sets the token parameter name for RequestForgery. Calling # `protect_from_forgery` sets it to `:authenticity_token` by default. config_accessor :request_forgery_protection_token self.request_forgery_protection_token ||= :authenticity_token # Holds the class which implements the request forgery protection. config_accessor :forgery_protection_strategy self.forgery_protection_strategy = nil # Controls whether request forgery protection is turned on or not. Turned off by # default only in test mode. config_accessor :allow_forgery_protection self.allow_forgery_protection = true if allow_forgery_protection.nil? # Controls whether a CSRF failure logs a warning. On by default. config_accessor :log_warning_on_csrf_failure self.log_warning_on_csrf_failure = true # Controls whether the Origin header is checked in addition to the CSRF token. config_accessor :forgery_protection_origin_check self.forgery_protection_origin_check = false # Controls whether form-action/method specific CSRF tokens are used. config_accessor :per_form_csrf_tokens self.per_form_csrf_tokens = false # The strategy to use for storing and retrieving CSRF tokens. config_accessor :csrf_token_storage_strategy self.csrf_token_storage_strategy = SessionStore.new helper_method :form_authenticity_token helper_method :protect_against_forgery? end
Class Attribute Details
._helper_methods (rw)
[ GitHub ]# File 'actionpack/lib/abstract_controller/helpers.rb', line 13
class_attribute :_helper_methods, default: Array.new
._helper_methods? ⇒ Boolean
(rw)
[ GitHub ]
# File 'actionpack/lib/abstract_controller/helpers.rb', line 13
class_attribute :_helper_methods, default: Array.new
.raise_on_missing_callback_actions (rw) Also known as: #raise_on_missing_callback_actions
[ GitHub ]# File 'actionpack/lib/abstract_controller/callbacks.rb', line 36
mattr_accessor :raise_on_missing_callback_actions, default: false
Instance Attribute Details
#_helper_methods (rw)
[ GitHub ]# File 'actionpack/lib/abstract_controller/helpers.rb', line 13
class_attribute :_helper_methods, default: Array.new
#_helper_methods? ⇒ Boolean
(rw)
[ GitHub ]
# File 'actionpack/lib/abstract_controller/helpers.rb', line 13
class_attribute :_helper_methods, default: Array.new
#any_authenticity_token_valid? ⇒ Boolean
(readonly, private)
Checks if any of the authenticity tokens from the request are valid.
# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 467
def any_authenticity_token_valid? # :doc: request_authenticity_tokens.any? do |token| valid_authenticity_token?(session, token) end end
#marked_for_same_origin_verification? ⇒ Boolean
(readonly, private)
If the #verify_authenticity_token before_action ran, verify that JavaScript responses are only served to same-origin GET requests.
# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 443
def marked_for_same_origin_verification? # :doc: @_marked_for_same_origin_verification ||= false end
#non_xhr_javascript_response? ⇒ Boolean
(readonly, private)
Check for cross-origin JavaScript responses.
# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 448
def non_xhr_javascript_response? # :doc: %r(\A(?:text|application)/javascript).match?(media_type) && !request.xhr? end
#protect_against_forgery? ⇒ Boolean
(readonly, private)
Checks if the controller allows forgery protection.
# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 610
def protect_against_forgery? # :doc: allow_forgery_protection && (!session.respond_to?(:enabled?) || session.enabled?) end
#raise_on_missing_callback_actions (rw)
[ GitHub ]# File 'actionpack/lib/abstract_controller/callbacks.rb', line 36
mattr_accessor :raise_on_missing_callback_actions, default: false
#valid_request_origin? ⇒ Boolean
(readonly, private)
Checks if the request originated from the same origin by looking at the Origin header.
# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 625
def valid_request_origin? # :doc: if forgery_protection_origin_check # We accept blank origin headers because some user agents don't send it. raise InvalidAuthenticityToken, NULL_ORIGIN_MESSAGE if request.origin == "null" request.origin.nil? || request.origin == request.base_url else true end end
#verified_request? ⇒ Boolean
(readonly, private)
Returns true or false if a request is verified. Checks:
-
Is it a GET or HEAD request? GETs should be safe and idempotent
-
Does the form_authenticity_token match the given token value from the params?
-
Does the
X-CSRF-Token
header match the form_authenticity_token?
# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 461
def verified_request? # :doc: !protect_against_forgery? || request.get? || request.head? || (valid_request_origin? && any_authenticity_token_valid?) end
Instance Method Details
#commit_csrf_token(request)
[ GitHub ]# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 374
def commit_csrf_token(request) # :doc: csrf_token = request.env[CSRF_TOKEN] csrf_token_storage_strategy.store(request, csrf_token) unless csrf_token.nil? end
#compare_with_global_token(token, session = nil) (private)
[ GitHub ]# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 548
def compare_with_global_token(token, session = nil) # :doc: ActiveSupport::SecurityUtils.fixed_length_secure_compare(token, global_csrf_token(session)) end
#compare_with_real_token(token, session = nil) (private)
[ GitHub ]# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 544
def compare_with_real_token(token, session = nil) # :doc: ActiveSupport::SecurityUtils.fixed_length_secure_compare(token, real_csrf_token(session)) end
#csrf_token_hmac(session, identifier) (private)
[ GitHub ]# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 585
def csrf_token_hmac(session, identifier) # :doc: OpenSSL::HMAC.digest( OpenSSL::Digest::SHA256.new, real_csrf_token(session), identifier ) end
#decode_csrf_token(encoded_csrf_token) (private)
[ GitHub ]# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 663
def decode_csrf_token(encoded_csrf_token) Base64.urlsafe_decode64(encoded_csrf_token) end
#encode_csrf_token(csrf_token) (private)
[ GitHub ]# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 659
def encode_csrf_token(csrf_token) Base64.urlsafe_encode64(csrf_token, padding: false) end
#form_authenticity_param (private)
The form’s authenticity parameter. Override to provide your own.
# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 605
def form_authenticity_param # :doc: params[request_forgery_protection_token] end
#form_authenticity_token(form_options: {}) (private)
Creates the authenticity token for the current request.
# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 479
def form_authenticity_token(form_options: {}) # :doc: masked_authenticity_token(form_options: ) end
#generate_csrf_token (private)
[ GitHub ]# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 655
def generate_csrf_token SecureRandom.urlsafe_base64(AUTHENTICITY_TOKEN_LENGTH) end
#global_csrf_token(session = nil) (private)
[ GitHub ]# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 581
def global_csrf_token(session = nil) # :doc: csrf_token_hmac(session, GLOBAL_CSRF_TOKEN_IDENTIFIER) end
#handle_unverified_request (private)
[ GitHub ]# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 399
def handle_unverified_request protection_strategy = forgery_protection_strategy.new(self) if protection_strategy.respond_to?(: ) protection_strategy. = end protection_strategy.handle_unverified_request end
#initialize
[ GitHub ]# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 364
def initialize(...) super @_marked_for_same_origin_verification = nil end
#mark_for_same_origin_verification! (private)
GET requests are checked for cross-origin JavaScript after rendering.
# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 437
def mark_for_same_origin_verification! # :doc: @_marked_for_same_origin_verification = request.get? end
#mask_token(raw_token) (private)
[ GitHub ]# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 537
def mask_token(raw_token) # :doc: one_time_pad = SecureRandom.random_bytes(AUTHENTICITY_TOKEN_LENGTH) encrypted_csrf_token = xor_byte_strings(one_time_pad, raw_token) masked_token = one_time_pad + encrypted_csrf_token encode_csrf_token(masked_token) end
#masked_authenticity_token(form_options: {}) (private)
Creates a masked version of the authenticity token that varies on each request. The masking is used to mitigate SSL attacks like BREACH.
# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 485
def masked_authenticity_token(form_options: {}) action, method = .values_at(:action, :method) raw_token = if per_form_csrf_tokens && action && method action_path = normalize_action_path(action) per_form_csrf_token(nil, action_path, method) else global_csrf_token end mask_token(raw_token) end
#normalize_action_path(action_path) (private)
[ GitHub ]# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 635
def normalize_action_path(action_path) # :doc: uri = URI.parse(action_path) if uri.relative? && (action_path.blank? || !action_path.start_with?("/")) normalize_relative_action_path(uri.path) else uri.path.chomp("/") end end
#normalize_relative_action_path(rel_action_path) (private)
[ GitHub ]# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 645
def normalize_relative_action_path(rel_action_path) # :doc: uri = URI.parse(request.path) # add the action path to the request.path uri.path += "/#{rel_action_path}" # relative path with "./path" uri.path.gsub!("/./", "/") uri.path.chomp("/") end
#per_form_csrf_token(session, action_path, method) (private)
[ GitHub ]# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 574
def per_form_csrf_token(session, action_path, method) # :doc: csrf_token_hmac(session, [action_path, method.downcase].join("#")) end
#real_csrf_token(_session = nil) (private)
[ GitHub ]# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 566
def real_csrf_token(_session = nil) # :doc: csrf_token = request.env.fetch(CSRF_TOKEN) do request.env[CSRF_TOKEN] = csrf_token_storage_strategy.fetch(request) || generate_csrf_token end decode_csrf_token(csrf_token) end
#request_authenticity_tokens (private)
Possible authenticity tokens sent in the request.
# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 474
def request_authenticity_tokens # :doc: [form_authenticity_param, request.x_csrf_token] end
#reset_csrf_token(request)
[ GitHub ]# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 369
def reset_csrf_token(request) # :doc: request.env.delete(CSRF_TOKEN) csrf_token_storage_strategy.reset(request) end
#unmask_token(masked_token) (private)
[ GitHub ]# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 530
def unmask_token(masked_token) # :doc: # Split the token into the one-time pad and the encrypted value and decrypt it. one_time_pad = masked_token[0...AUTHENTICITY_TOKEN_LENGTH] encrypted_csrf_token = masked_token[AUTHENTICITY_TOKEN_LENGTH..-1] xor_byte_strings(one_time_pad, encrypted_csrf_token) end
#unverified_request_warning_message (private)
[ GitHub ]# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 409
def if valid_request_origin? "Can't verify CSRF token authenticity." else "HTTP Origin header (#{request.origin}) didn't match request.base_url (#{request.base_url})" end end
#valid_authenticity_token?(session, encoded_masked_token) ⇒ Boolean
(private)
Checks the client’s masked token to see if it matches the session token. Essentially the inverse of #masked_authenticity_token.
# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 500
def valid_authenticity_token?(session, encoded_masked_token) # :doc: if encoded_masked_token.nil? || encoded_masked_token.empty? || !encoded_masked_token.is_a?(String) return false end begin masked_token = decode_csrf_token(encoded_masked_token) rescue ArgumentError # encoded_masked_token is invalid Base64 return false end # See if it's actually a masked token or not. In order to deploy this code, we # should be able to handle any unmasked tokens that we've issued without error. if masked_token.length == AUTHENTICITY_TOKEN_LENGTH # This is actually an unmasked token. This is expected if you have just upgraded # to masked tokens, but should stop happening shortly after installing this gem. compare_with_real_token masked_token elsif masked_token.length == AUTHENTICITY_TOKEN_LENGTH * 2 csrf_token = unmask_token(masked_token) compare_with_global_token(csrf_token) || compare_with_real_token(csrf_token) || valid_per_form_csrf_token?(csrf_token) else false # Token is malformed. end end
#valid_per_form_csrf_token?(token, session = nil) ⇒ Boolean
(private)
# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 552
def valid_per_form_csrf_token?(token, session = nil) # :doc: if per_form_csrf_tokens correct_token = per_form_csrf_token( session, request.path.chomp("/"), request.request_method ) ActiveSupport::SecurityUtils.fixed_length_secure_compare(token, correct_token) else false end end
#verify_authenticity_token (private)
The actual before_action that is used to verify the CSRF token. Don’t override this directly. Provide your own forgery protection strategy instead. If you override, you’ll disable same-origin verification.
Lean on the protect_from_forgery declaration to mark which actions are due for same-origin request verification. If protect_from_forgery is enabled on an action, this before_action flags its after_action to verify that JavaScript responses are for XHR requests, ensuring they follow the browser’s same-origin policy.
# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 389
def verify_authenticity_token # :doc: mark_for_same_origin_verification! if !verified_request? logger.warn if logger && log_warning_on_csrf_failure handle_unverified_request end end
#verify_same_origin_request (private)
If #verify_authenticity_token was run (indicating that we have forgery protection enabled for this request) then also verify that we aren’t serving an unauthorized cross-origin response.
# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 427
def verify_same_origin_request # :doc: if marked_for_same_origin_verification? && non_xhr_javascript_response? if logger && log_warning_on_csrf_failure logger.warn CROSS_ORIGIN_JAVASCRIPT_WARNING end raise ActionController::InvalidCrossOriginRequest, CROSS_ORIGIN_JAVASCRIPT_WARNING end end
#xor_byte_strings(s1, s2) (private)
[ GitHub ]# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 593
def xor_byte_strings(s1, s2) # :doc: s2 = s2.dup size = s1.bytesize i = 0 while i < size s2.setbyte(i, s1.getbyte(i) ^ s2.getbyte(i)) i += 1 end s2 end