class Rack::Protection::RemoteToken

Prevented attack

CSRF

Supported browsers

all

More infos

en.wikipedia.org/wiki/Cross-site_request_forgery

Only accepts unsafe HTTP requests if a given access token matches the token included in the session or the request comes from the same origin.

Compatible with rack-csrf.

Public Instance Methods

accepts?(env) click to toggle source
# File lib/rack/protection/remote_token.rb, line 17
def accepts?(env)
  super or referrer(env) == Request.new(env).host
end