protect_from_forgery(options = {}) public

Turn on request forgery protection. Bear in mind that only non-GET, HTML/JavaScript requests are checked.

Example: 

  class FooController < ApplicationController
    # uses the cookie session store (then you don't need a separate :secret)
    protect_from_forgery :except => :index

    # uses one of the other session stores that uses a session_id value.
    protect_from_forgery :secret => 'my-little-pony', :except => :index

    # you can disable csrf protection on controller-by-controller basis:
    skip_before_filter :verify_authenticity_token
  end

Valid Options:

  • :only/:except - Passed to the before_filter call. Set which actions are verified.
  • :secret - Custom salt used to generate the form_authenticity_token. Leave this off if you are using the cookie session store.
  • :digest - Message digest used for hashing. Defaults to ‘SHA1’.
Show source
Register or log in to add new notes.
May 12, 2009
2 thanks

form_authenticity_token

Instead of disabling the CSRF check you can pass the authenticity_token field in your forms, eg:

<%= hidden_field_tag :authenticity_token, form_authenticity_token -%>