method

verify_authenticity_token

Ruby on Rails latest stable (v7.1.3.2) - 0 notes - Class: ActionController::RequestForgeryProtection

verify_authenticity_token() private

The actual before_action that is used to verify the CSRF token. Don’t override this directly. Provide your own forgery protection strategy instead. If you override, you’ll disable same-origin <script> verification.

Lean on the protect_from_forgery declaration to mark which actions are due for same-origin request verification. If protect_from_forgery is enabled on an action, this before_action flags its after_action to verify that JavaScript responses are for XHR requests, ensuring they follow the browser’s same-origin policy.

Show source

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 371
      def verify_authenticity_token # :doc:
        mark_for_same_origin_verification!

        if !verified_request?
          logger.warn unverified_request_warning_message if logger && log_warning_on_csrf_failure

          handle_unverified_request
        end
      end

verify_authenticity_token

Related methods