Skip to content

Fix CSRF InvalidAuthenticityToken - #86

Open
cprodhomme wants to merge 1 commit into
zorab47:masterfrom
captive-studio:fix-CSRF-InvalidAuthenticityToken
Open

Fix CSRF InvalidAuthenticityToken#86
cprodhomme wants to merge 1 commit into
zorab47:masterfrom
captive-studio:fix-CSRF-InvalidAuthenticityToken

Conversation

@cprodhomme

Copy link
Copy Markdown
Contributor

No description provided.

@zorab47

zorab47 commented Feb 22, 2020

Copy link
Copy Markdown
Owner

Any worries of raising JS errors if that attribute is missing? How do other plugins solve this problem?

@cprodhomme

Copy link
Copy Markdown
Contributor Author

many people speak about put this line skip_before_filter :verify_authenticity_token into their controller but it's a huge mistake because the authenticity token is a random value generated in your view to prove a request is submitted from a form on your site, not somewhere else. This protects against CSRF attacks.

maybe, you need to check before the value $('meta[name=csrf-token]') is not null 🤔

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants