instance method
verified_request?
Ruby on Rails edge
Private — implementation detail, not part of the public APISignature
verified_request?()Returns true or false if a request is verified. The verification method depends on the configured forgery_protection_verification_strategy:
-
:header_only- Uses Sec-Fetch-Site header only (default) -
:header_or_legacy_token- Uses Sec-Fetch-Site header with fallback to token
For all strategies, GET, HEAD, and QUERY requests are allowed without verification. HTML forms cannot issue QUERY requests, and cross-origin QUERY requests always require a CORS preflight, so they cannot be forged through a victim’s browser. A request tunneled through a form POST with _method=query does not share that protection, so it is verified like any other POST.
Source
# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 615
def verified_request? # :doc:
request.get? || request.head? || verified_query_request? || !protect_against_forgery? ||
(valid_request_origin? && verified_request_for_forgery_protection?)
end
Defined in actionpack/lib/action_controller/metal/request_forgery_protection.rb line 615
· View on GitHub
· Improve this page
· Find usages on GitHub
Defined in ActionController::RequestForgeryProtection