Module | ActionController::RequestForgeryProtection
In: | lib/action_controller/request_forgery_protection.rb

### Methods

authenticity_token_from_cookie_session authenticity_token_from_session_id form_authenticity_token included protect_against_forgery? verifiable_request_format? verified_request? verify_authenticity_token

### Classes and Modules

Module ActionController::RequestForgeryProtection::ClassMethods

### Public Class methods

included(base)

### Protected Instance methods

authenticity_token_from_cookie_session()

No secret was given, so assume this is a cookie session store.

authenticity_token_from_session_id()

Generates a unique digest using the session_id and the CSRF secret.

form_authenticity_token()

Sets the token value for the current session. Pass a `:secret` option in `protect_from_forgery` to add a custom salt to the hash.

protect_against_forgery?()
verifiable_request_format?()
verified_request?()

Returns true or false if a request is verified. Checks:

- is the format restricted? By default, only HTML and AJAX requests are checked.
- is it a GET request? Gets should be safe and idempotent
- Does the form_authenticity_token match the given _token value from the params?

verify_authenticity_token()

The actual before_filter that is used. Modify this to change how you handle unverified requests.

[Validate]