instance method `protect_from_forgery`

Ruby on Rails 2.3.18

Since v2.2.3

Available in: v2.2.3 v2.3.18 v3.0.20 v3.1.12 v3.2.22.5 v4.0.13 v4.1.16 v4.2.9 v5.2.8.1 v6.0.6 v6.1.7.10 v7.0.10 v7.1.6 v7.2.3 v8.0.4 v8.1.2

Compare with:

protect_from_forgery(options = {})

Turn on request forgery protection. Bear in mind that only non-GET, HTML/JavaScript requests are checked.

Example:

class FooController < ApplicationController
  protect_from_forgery :except => :index

  # you can disable csrf protection on controller-by-controller basis:
  skip_before_filter :verify_authenticity_token
end

Valid Options:

:only/:except - Passed to the before_filter call. Set which actions are verified.

Parameters

options opt = {}

Source

# File actionpack/lib/action_controller/request_forgery_protection.rb, line 67
      def protect_from_forgery(options = {})
        self.request_forgery_protection_token ||= :authenticity_token
        before_filter :verify_authenticity_token, :only => options.delete(:only), :except => options.delete(:except)
        if options[:secret] || options[:digest]
          ActiveSupport::Deprecation.warn("protect_from_forgery only takes :only and :except options now. :digest and :secret have no effect", caller)
        end
      end

Defined in actionpack/lib/action_controller/request_forgery_protection.rb line 67 · View on GitHub · Improve this page · Find usages on GitHub

Defined in ActionController::RequestForgeryProtection::ClassMethods

Signature

Parameters