4 ms·
I didn't think I'd be upvoting something that compares Microsoft to Rails, but in this case I totally agree. I wasn't aware that all this cleverness is taking
by gingerlime 12y ago
I didn't think I'd be upvoting something that compares Microsoft to Rails, but in this case I totally agree.
I wasn't aware that all this cleverness is taking place instead of raising an error.
Does this also mean that any user who is attacked with CSRF gets logged out of the website?
- Someone1234 12y ago> Does this also mean that any user who is attacked with CSRF gets logged out of the website? Nope. It only strips it from the specific request that fails the CSRF validator. A client shouldn't notice.
- yourmysin 12y agoExactly. The session information is stripped from the request, but the session is not really "destroyed." Rails leverages client side sessions, which are signed to prevent tampering. Because of this nature, however, sessions can be constantly replayed.
- gingerlime 12y agoBut most apps move away from client-side sessions and use some kind of a session store (in memory, redis, memcache typically). In this case, the session.destroy should really destroy the session, meaning the user will be logged out (that's as far as I can tell without actually trying it)