title: Rails: How Does csrf_meta_tag Work?
body: <p>I'm a PHP developer learning Ruby on Rails by reading <a href="http://ruby.railstutorial.org/ruby-on-rails-tutorial-book" rel="noreferrer">Michael Hartl's tutorial</a>. Here is a quote from the book, referring to <code>csrf_meta_tag</code>:</p>
  
  <blockquote>
    <p>...the Rails method <code>csrf_meta_tag</code> [prevents] cross-site request
    forgery (CSRF), a type of malicious web attack. Don’t worry about the
    details (I don’t); just know that Rails is working hard to keep your
    application secure.</p>
  </blockquote>
  
  <p>The thing is, I'm genuinely curious. How does inserting <code>csrf-param</code> and <code>csrf-token</code> meta tags prevent CSRF? I tried Googling, but couldn't find anything.</p>