4 ms·

"The other 'a' cookie, a_xs, is now also deleted on logout. a_xs is used to prevent cross-site request forgery." Does anyone know how this cookie is used to pr

• epochwolf 15y ago
  Rails matches a session csrf token against form data to detect if someone is trying to submit a form without a proper token. This session data is stored in a cookie by default. This functionality is referenced in the security guide. http://guides.rubyonrails.org/security.html#csrf-countermeasures http://guides.rubyonrails.org/security.html#csrf-countermeas...
  • mjs 15y ago
    From my reading of that link, in Rails it's not the CSRF token itself that's stored in the cookie, it's the secret used to verify the token. If Facebook is doing the same thing, there would be no need to store the secret after the user has logged out--just generate another secret the next time they log in.
    • epochwolf 15y ago
      The login form still requires a secret as does any other links that have side effects. I would imagine the like buttons require them to work properly.