4 ms·
Rails matches a session csrf token against form data to detect if someone is trying to submit a form without a proper token. This session data is stored in a co
by epochwolf 15y ago
Rails matches a session csrf token against form data to detect if someone is trying to submit a form without a proper token. This session data is stored in a cookie by default.
This functionality is referenced in the security guide.
http://guides.rubyonrails.org/security.html#csrf-countermeasures http://guides.rubyonrails.org/security.html#csrf-countermeas...
- mjs 15y agoFrom my reading of that link, in Rails it's not the CSRF token itself that's stored in the cookie, it's the secret used to verify the token. If Facebook is doing the same thing, there would be no need to store the secret after the user has logged out--just generate another secret the next time they log in.
- epochwolf 15y agoThe login form still requires a secret as does any other links that have side effects. I would imagine the like buttons require them to work properly.