Skip to content

Instantly share code, notes, and snippets.

@shotgundebugging

shotgundebugging/request_forgery_protection.rb

Forked from mctaylorpants/request_forgery_protection.rb
Created January 5, 2024 12:08
Show Gist options
  • Save shotgundebugging/e1cc846c2c7bd9b7fff808d97922d2ac to your computer and use it in GitHub Desktop.
Save shotgundebugging/e1cc846c2c7bd9b7fff808d97922d2ac to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @mctaylorpants mctaylorpants revised this gist Jul 30, 2017. 1 changed file with 3 additions and 2 deletions.
    5 changes: 3 additions & 2 deletions request_forgery_protection.rb
    View file
    Original file line number Diff line number Diff line change
    @@ -10,12 +10,13 @@ def form_authenticity_token(form_options: {})
    # like BREACH.
    def masked_authenticity_token(session, form_options: {}) # :doc:
      # ...
    raw_token = if per_form_csrf_tokens && action && method
    raw_token = if per_form_csrf_tokens && action && method
      # ...
      else
      real_csrf_token(session)
      end
    one_time_pad = SecureRandom.random_bytes(AUTHENTICITY_TOKEN_LENGTH)

    one_time_pad = SecureRandom.random_bytes(AUTHENTICITY_TOKEN_LENGTH)
      encrypted_csrf_token = xor_byte_strings(one_time_pad, raw_token)
      masked_token = one_time_pad + encrypted_csrf_token
      Base64.strict_encode64(masked_token)
  2. @mctaylorpants mctaylorpants revised this gist Jul 30, 2017. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions request_forgery_protection.rb
    View file
    Original file line number Diff line number Diff line change
    @@ -4,6 +4,7 @@
    def form_authenticity_token(form_options: {})
      masked_authenticity_token(session, form_options: form_options)
    end

    # Creates a masked version of the authenticity token that varies
    # on each request. The masking is used to mitigate SSL attacks
    # like BREACH.
  3. @mctaylorpants mctaylorpants created this gist Jul 30, 2017.
    21 changes: 21 additions & 0 deletions request_forgery_protection.rb
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,21 @@
    # actionpack/lib/action_controller/metal/request_forgery_protection.rb

    # Sets the token value for the current session.
    def form_authenticity_token(form_options: {})
      masked_authenticity_token(session, form_options: form_options)
    end
    # Creates a masked version of the authenticity token that varies
    # on each request. The masking is used to mitigate SSL attacks
    # like BREACH.
    def masked_authenticity_token(session, form_options: {}) # :doc:
      # ...
    raw_token = if per_form_csrf_tokens && action && method
      # ...
      else
      real_csrf_token(session)
      end
    one_time_pad = SecureRandom.random_bytes(AUTHENTICITY_TOKEN_LENGTH)
      encrypted_csrf_token = xor_byte_strings(one_time_pad, raw_token)
      masked_token = one_time_pad + encrypted_csrf_token
      Base64.strict_encode64(masked_token)
    end