Rails: How Does csrf_meta_tag Work?

ruby-on-rails csrf
Nick picture Nick · Apr 3, 2012 · Viewed 51.6k times · Source

I'm a PHP developer learning Ruby on Rails by reading Michael Hartl's tutorial. Here is a quote from the book, referring to csrf_meta_tag:

...the Rails method csrf_meta_tag [prevents] cross-site request forgery (CSRF), a type of malicious web attack. Don’t worry about the details (I don’t); just know that Rails is working hard to keep your application secure.

The thing is, I'm genuinely curious. How does inserting csrf-param and csrf-token meta tags prevent CSRF? I tried Googling, but couldn't find anything.

Answer

Frederick Cheung picture Frederick Cheung · Apr 3, 2012

csrf_meta_tag is basically fulfilling the same thing as hidden form fields but is there to give javascript requests that aren't tied to a form an easy way of getting the token.

If you use the jquery-ujs library the content of that meta tag is automatically added (as a request header) to any ajax requests made.

Related questions

WARNING: Can't verify CSRF token authenticity rails

I am sending data from view to controller with AJAXand I got this error: WARNING: Can't verify CSRF token authenticity I think I have to send this token with data. Does anyone know how can I do this ? Edit: My …

Read More
Rails CSRF Protection + Angular.js: protect_from_forgery makes me to log out on POST

If the protect_from_forgery option is mentioned in application_controller, then I can log in and perform any GET requests, but on very first POST request Rails resets the session, which logs me out. I turned the protect_from_…

Read More
Rails - How to add CSRF Protection to forms created in javascript?

I'm using backbone.js and it works great. but the forms I'm creating as a javascript template lacks the rails csrf protection token. How do I add it to templates I'm creating in javascript?

Read More