Rails 4.2
Rails 4.2
  • 请登录查看
字典 我要纠错

ActionController::RequestForgeryProtection

module ActionController::RequestForgeryProtection

Included modules:
AbstractController::Helpers, AbstractController::Callbacks

Controller actions are protected from Cross-Site Request Forgery (CSRF) attacks by including a token in the rendered HTML for your application. This token is stored as a random string in the session, to which an attacker does not have access. When a request reaches your application, Rails verifies the received token with the token in the session. Only HTML and JavaScript requests are checked, so this will not protect your XML API (presumably you'll have a different authentication scheme there anyway).

GET requests are not protected since they don't have side effects li