4 ms·
From my reading of that link, in Rails it's not the CSRF token itself that's stored in the cookie, it's the secret used to verify the token. If Facebook is doi
by mjs 15y ago
From my reading of that link, in Rails it's not the CSRF token itself that's stored in the cookie, it's the secret used to verify the token. If Facebook is doing the same thing, there would be no need to store the secret after the user has logged out--just generate another secret the next time they log in.
- epochwolf 15y agoThe login form still requires a secret as does any other links that have side effects. I would imagine the like buttons require them to work properly.