method

masked_authenticity_token

v4.2.1 - Show latest stable - Class: ActionController::RequestForgeryProtection

masked_authenticity_token(session)

protected

Creates a masked version of the authenticity token that varies on each request. The masking is used to mitigate SSL attacks like BREACH.

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 266
      def masked_authenticity_token(session)
        one_time_pad = SecureRandom.random_bytes(AUTHENTICITY_TOKEN_LENGTH)
        encrypted_csrf_token = xor_byte_strings(one_time_pad, real_csrf_token(session))
        masked_token = one_time_pad + encrypted_csrf_token
        Base64.strict_encode64(masked_token)
      end

masked_authenticity_token

Related methods