Helpers to generate form security tags for csrf protection.
Constructs a hidden field containing a CSRF token.
@param [String] token
The token to use. Will be read from the session by default.
@return [String] The hidden field with CSRF token as value.
@example
csrf_token_field
# File lib/padrino-helpers/form_helpers/security.rb, line 21 def csrf_token_field hidden_field_tag csrf_param, :value => csrf_token end
Returns the param/field name in which your CSRF token should be expected by your controllers. Defaults to `authenticity_token`.
Set this in your application with `set :#csrf_param, :something_else`.
# File lib/padrino-helpers/form_helpers/security.rb, line 64 def csrf_param defined?(settings) && settings.respond_to?(:csrf_param) ? settings.csrf_param : :authenticity_token end
Returns the current CSRF token (based on the session). If it doesn’t exist, it will create one and assign it to the session’s `csrf` key.
# File lib/padrino-helpers/form_helpers/security.rb, line 54 def csrf_token session[:csrf] ||= SecureRandom.hex(32) if defined?(session) end
Returns whether the application is being protected from CSRF. Defaults to true.
# File lib/padrino-helpers/form_helpers/security.rb, line 46 def is_protected_from_csrf? defined?(settings) ? settings.protect_from_csrf : true end