class Rack::Protection::AuthenticityToken
- Prevented attack
-
CSRF
- Supported browsers
-
all
- More infos
Only accepts unsafe HTTP requests if a given access token matches the token included in the session.
Compatible with rack-csrf.
Options:
authenticity_param: Defines the param's name that should contain the token on a request.
Constants
- TOKEN_LENGTH
Public Class Methods
random_token()
click to toggle source
# File lib/rack/protection/authenticity_token.rb, line 30 def self.random_token SecureRandom.base64(TOKEN_LENGTH) end
token(session)
click to toggle source
# File lib/rack/protection/authenticity_token.rb, line 26 def self.token(session) self.new(nil).mask_authenticity_token(session) end
Public Instance Methods
accepts?(env)
click to toggle source
# File lib/rack/protection/authenticity_token.rb, line 34 def accepts?(env) session = session env set_token(session) safe?(env) || valid_token?(session, env['HTTP_X_CSRF_TOKEN']) || valid_token?(session, Request.new(env).params[options[:authenticity_param]]) || ( options[:allow_if] && options[:allow_if].call(env) ) end
mask_authenticity_token(session)
click to toggle source
# File lib/rack/protection/authenticity_token.rb, line 44 def mask_authenticity_token(session) token = set_token(session) mask_token(token) end
Private Instance Methods
compare_with_real_token(token, session)
click to toggle source
# File lib/rack/protection/authenticity_token.rb, line 111 def compare_with_real_token(token, session) secure_compare(token, real_token(session)) end
decode_token(token)
click to toggle source
# File lib/rack/protection/authenticity_token.rb, line 123 def decode_token(token) Base64.strict_decode64(token) end
encode_token(token)
click to toggle source
# File lib/rack/protection/authenticity_token.rb, line 119 def encode_token(token) Base64.strict_encode64(token) end
mask_token(token)
click to toggle source
Creates a masked version of the authenticity token that varies on each request. The masking is used to mitigate SSL attacks like BREACH.
# File lib/rack/protection/authenticity_token.rb, line 85 def mask_token(token) token = decode_token(token) one_time_pad = SecureRandom.random_bytes(token.length) encrypted_token = xor_byte_strings(one_time_pad, token) masked_token = one_time_pad + encrypted_token encode_token(masked_token) end
masked_token?(token)
click to toggle source
# File lib/rack/protection/authenticity_token.rb, line 107 def masked_token?(token) token.length == TOKEN_LENGTH * 2 end
real_token(session)
click to toggle source
# File lib/rack/protection/authenticity_token.rb, line 115 def real_token(session) decode_token(session[:csrf]) end
set_token(session)
click to toggle source
# File lib/rack/protection/authenticity_token.rb, line 51 def set_token(session) session[:csrf] ||= self.class.random_token end
unmask_token(masked_token)
click to toggle source
Essentially the inverse of mask_token
.
# File lib/rack/protection/authenticity_token.rb, line 94 def unmask_token(masked_token) # Split the token into the one-time pad and the encrypted # value and decrypt it token_length = masked_token.length / 2 one_time_pad = masked_token[0...token_length] encrypted_token = masked_token[token_length..-1] xor_byte_strings(one_time_pad, encrypted_token) end
unmasked_token?(token)
click to toggle source
# File lib/rack/protection/authenticity_token.rb, line 103 def unmasked_token?(token) token.length == TOKEN_LENGTH end
valid_token?(session, token)
click to toggle source
Checks the client's masked token to see if it matches the session token.
# File lib/rack/protection/authenticity_token.rb, line 57 def valid_token?(session, token) return false if token.nil? || token.empty? begin token = decode_token(token) rescue ArgumentError # encoded_masked_token is invalid Base64 return false end # See if it's actually a masked token or not. We should be able # to handle any unmasked tokens that we've issued without error. if unmasked_token?(token) compare_with_real_token token, session elsif masked_token?(token) token = unmask_token(token) compare_with_real_token token, session else false # Token is malformed end end
xor_byte_strings(s1, s2)
click to toggle source
# File lib/rack/protection/authenticity_token.rb, line 127 def xor_byte_strings(s1, s2) s1.bytes.zip(s2.bytes).map { |(c1,c2)| c1 ^ c2 }.pack('c*') end