Module: Otto::Security::CSRFValidation

Included in:: CSRFEnforcementWrapper

Defined in:: lib/otto/security/csrf_validation.rb

Overview

Shared CSRF token mechanics.

Both the global +CSRFMiddleware+ (which injects tokens into HTML responses) and the per-route +CSRFEnforcementWrapper+ (which enforces tokens on unsafe requests, honoring +csrf=exempt+) mix this in so the two cannot drift on what counts as a safe method, where a token may be carried, or how a rejection is shaped. The including object must expose a +@config+ (an +Otto::Security::Config+).

Constant Summary collapse

SAFE_METHODS = HTTP methods that never mutate state and so are exempt from token validation (RFC 7231 safe methods plus TRACE).

%w[GET HEAD OPTIONS TRACE].freeze

CSRF_ERROR_BODY = Static 403 body. Frozen once so a rejected request does not re-serialize the same JSON on every call.

{
    error: 'CSRF token validation failed',
  message: 'The request could not be authenticated. Please refresh the page and try again.',
}.to_json.freeze