actionpack/lib/action_controller/metal/request_forgery_protection.rb
# Checks the client's masked token to see if it matches the
# session token. Essentially the inverse of
# +masked_authenticity_token+.
Checks the client's masked token to see if it matches the
session token. Essentially the inverse of
+masked_authenticity_token+.
Checks the client ' s masked token to see if it matches the session token . Essentially the inverse of + masked_authenticity_token + .
def valid_authenticity_token?(session, encoded_masked_token) 
        if encoded_masked_token.nil? || encoded_masked_token.empty? || !encoded_masked_token.is_a?(String)
          return false
        end
        begin
          masked_token = decode_csrf_token(encoded_masked_token)
        rescue ArgumentError 
          return false
        end
        if masked_token.length == AUTHENTICITY_TOKEN_LENGTH
          compare_with_real_token masked_token
        elsif masked_token.length == AUTHENTICITY_TOKEN_LENGTH * 2
          csrf_token = unmask_token(masked_token)
          compare_with_global_token(csrf_token) ||
            compare_with_real_token(csrf_token) ||
            valid_per_form_csrf_token?(csrf_token)
        else
          false 
        end
      end
def valid_authenticity_token? ( session , encoded_masked_token ) if encoded_masked_token . nil? || encoded_masked_token . empty? || ! encoded_masked_token . is_a? ( String ) return false end begin masked_token = decode_csrf_token ( encoded_masked_token ) rescue ArgumentError return false end if masked_token . length == AUTHENTICITY_TOKEN_LENGTH compare_with_real_token masked_token elsif masked_token . length == AUTHENTICITY_TOKEN_LENGTH * 2 csrf_token = unmask_token ( masked_token ) compare_with_global_token ( csrf_token ) || compare_with_real_token ( csrf_token ) || valid_per_form_csrf_token? ( csrf_token ) else false end end
Checks the client's masked token to see if it matches the
session token.
Checks the client ' s masked token to see if it matches the session token .
# :doc: # encoded_masked_token is invalid Base64 # See if it's actually a masked token or not. In order to # deploy this code, we should be able to handle any unmasked # tokens that we've issued without error. # This is actually an unmasked token. This is expected if # you have just upgraded to masked tokens, but should stop # happening shortly after installing this gem. # Token is malformed.
session
<not_specific>
encoded_masked_token
<not_specific>