4 ms·

This explains a lot, but thing it doesn't cover is why the patch for Rails ends the session when a CSRF token is missing. I'm guessing this is just extra paran

• tptacek 16y ago
  I do not know, and I hope it's just paranoia, because that's a giant pain in the ass.
• smunz 16y ago
  I guess they forced the end of the session to allow non-session authentication, for example for an Client accessing an RESTful API. I didn't found anything about this, but when you look at the related commit in rails (https://github.com/rails/rails/commit/66ce3843d32e9f2ac3b1da20067af53019bbb034#L1L144 https://github.com/rails/rails/commit/66ce3843d32e9f2ac3b1da...) they also removed the white listing an all non html-requests ("content_mime_type.verify_request?"). So any (api) client modifying XML or JSON resources of an rails app would not be allowed to do so, because of the need to provide the authentication token. Which isn't available for an API client, because there is no session. So instead of throwing an exception to prevent an CSRF-attack they just kill the session to prevent authentication by this session. For an api client this is no big deal, because normally it authenticates with per request credentials. If you don't feel/have the need to support non session authentication, my guess is you could simply overwrite the handle_unverified_request method in your application controller to throw an exception again. But I would wait for further explanation by the rails core team.