Module: Otto::Security::CSRFHelpers

Defined in:
lib/otto/security/csrf.rb

Overview

Helper methods for CSRF token handling in views and controllers

Instance Method Summary collapse

Instance Method Details

#csrf_form_tag ⇒ Object 



164
165
166
 
# File 'lib/otto/security/csrf.rb', line 164

def csrf_form_tag
  %(<input type="hidden" name="#{csrf_token_key}" value="#{csrf_token}">)
end

#csrf_meta_tag ⇒ Object 



160
161
162
 
# File 'lib/otto/security/csrf.rb', line 160

def csrf_meta_tag
  %(<meta name="csrf-token" content="#{csrf_token}">)
end

#csrf_token ⇒ Object 



152
153
154
155
156
157
158
 
# File 'lib/otto/security/csrf.rb', line 152

def csrf_token
  if @csrf_token.nil? && otto.respond_to?(:security_config)
    session_id  = otto.security_config.get_or_create_session_id(req)
    @csrf_token = otto.security_config.generate_csrf_token(session_id)
  end
  @csrf_token
end

#csrf_token_key ⇒ Object 



168
169
170
171
172
173
174
 
# File 'lib/otto/security/csrf.rb', line 168

def csrf_token_key
  if otto.respond_to?(:security_config)
    otto.security_config.csrf_token_key
  else
    '_csrf_token'
  end
end