module Grape::ForgeryProtection::Helpers

Public Instance Methods

csrf_token_from_headers() click to toggle source
# File lib/grape/forgery_protection/helpers.rb, line 17
def csrf_token_from_headers
  request.headers['X-CSRF-Token'].presence ||
    request.headers['X-Csrf-Token']
end
form_authenticity_token() click to toggle source
# File lib/grape/forgery_protection/helpers.rb, line 22
def form_authenticity_token
  session[:_csrf_token] ||= SecureRandom.base64(32)
end
protect_against_forgery() click to toggle source
# File lib/grape/forgery_protection/helpers.rb, line 8
def protect_against_forgery
  error!('Unauthorized', 401) unless verified_request?
end
protect_against_forgery?() click to toggle source
# File lib/grape/forgery_protection/helpers.rb, line 26
def protect_against_forgery?
  allow_forgery_protection = Rails
    .configuration
    .action_controller
    .allow_forgery_protection

  allow_forgery_protection.nil? || allow_forgery_protection
end
session() click to toggle source
# File lib/grape/forgery_protection/helpers.rb, line 4
def session
  env['rack.session']
end
verified_request?() click to toggle source
# File lib/grape/forgery_protection/helpers.rb, line 12
def verified_request?
  !protect_against_forgery? || request.get? || request.head? ||
    form_authenticity_token == csrf_token_from_headers
end