actionpack/lib/action_controller/metal/request_forgery_protection.rb
# Turn on request forgery protection. Bear in mind that GET and HEAD requests are not checked.
#
#   class ApplicationController < ActionController::Base
#     protect_from_forgery
#   end
#
#   class FooController < ApplicationController
#     protect_from_forgery except: :index
#   end
#
# You can disable forgery protection on controller by skipping the verification before_action:
#
#   skip_before_action :verify_authenticity_token
#
# Valid Options:
#
# * <tt>:only/:except</tt> - Only apply forgery protection to a subset of actions. For example <tt>only: [ :create, :create_all ]</tt>.
# * <tt>:if/:unless</tt> - Turn off the forgery protection entirely depending on the passed Proc or method reference.
# * <tt>:prepend</tt> - By default, the verification of the authentication token will be added at the position of the
#   protect_from_forgery call in your application. This means any callbacks added before are run first. This is useful
#   when you want your forgery protection to depend on other callbacks, like authentication methods (Oauth vs Cookie auth).
#
#   If you need to add verification to the beginning of the callback chain, use <tt>prepend: true</tt>.
# * <tt>:with</tt> - Set the method to handle unverified request.
#
# Built-in unverified request handling methods are:
# * <tt>:exception</tt> - Raises ActionController::InvalidAuthenticityToken exception.
# * <tt>:reset_session</tt> - Resets the session.
# * <tt>:null_session</tt> - Provides an empty session during request but doesn't reset it completely. Used as default if <tt>:with</tt> option is not specified.
#
# You can also implement custom strategy classes for unverified request handling:
#
#    class CustomStrategy
#      def initialize(controller)
#        @controller = controller
#      end
#
#      def handle_unverified_request
#        # Custom behaviour for unverfied request
#      end
#    end
#
#    class ApplicationController < ActionController:x:Base
#      protect_from_forgery with: CustomStrategy
#    end
Turn on request forgery protection. Bear in mind that GET and HEAD requests are not checked.



You can disable forgery protection on controller by skipping the verification before_action.



Valid Options.

:only/:except - Only apply forgery protection to a subset of actions. For example only: [ :create, :create_all ].
:if/:unless - Turn off the forgery protection entirely depending on the passed Proc or method reference.
:prepend - By default, the verification of the authentication token will be added at the position of the
protect_from_forgery call in your application. This means any callbacks added before are run first. This is useful
when you want your forgery protection to depend on other callbacks, like authentication methods (Oauth vs Cookie auth).

If you need to add verification to the beginning of the callback chain, use prepend: true.
:with - Set the method to handle unverified request.

Built-in unverified request handling methods are:
:exception - Raises ActionController::InvalidAuthenticityToken exception.
:reset_session - Resets the session.
:null_session - Provides an empty session during request but doesn't reset it completely. Used as default if :with option is not specified.

You can also implement custom strategy classes for unverified request handling.



def handle_unverified_request
Custom behaviour for unverfied request
end
end


Turn on request forgery protection . Bear in mind that GET and HEAD requests are not checked . You can disable forgery protection on controller by skipping the verification before_action . Valid Options . : only / : except - Only apply forgery protection to a subset of actions . For example only : [ : create : create_all ] . : if / : unless - Turn off the forgery protection entirely depending on the passed Proc or method reference . : prepend - By default the verification of the authentication token will be added at the position of the protect_from_forgery call in your application . This means any callbacks added before are run first . This is useful when you want your forgery protection to depend on other callbacks like authentication methods ( Oauth vs Cookie auth ) . If you need to add verification to the beginning of the callback chain use prepend : true . : with - Set the method to handle unverified request . Built - in unverified request handling methods are : : exception - Raises ActionController :: InvalidAuthenticityToken exception . : reset_session - Resets the session . : null_session - Provides an empty session during request but doesn ' t reset it completely . Used as default if : with option is not specified . You can also implement custom strategy classes for unverified request handling . def handle_unverified_request Custom behaviour for unverfied request end end
def protection_method_class(name)
          case name
          when :null_session
            ProtectionMethods::NullSession
          when :reset_session
            ProtectionMethods::ResetSession
          when :exception
            ProtectionMethods::Exception
          when Class
            name
          else
            raise ArgumentError, "Invalid request forgery protection method, use :null_session, :exception, :reset_session, or a custom forgery protection class."
          end
        end
def protection_method_class ( name ) case name when :null_session ProtectionMethods :: NullSession when :reset_session ProtectionMethods :: ResetSession when :exception ProtectionMethods :: Exception when Class name else raise ArgumentError , "Invalid request forgery protection method, use :null_session, :exception, :reset_session, or a custom forgery protection class." end end
Turn on request forgery protection.
Turn on request forgery protection .
name
<not_specific>