module Roda::RodaPlugins::RouteCsrf::InstanceMethods

  1. lib/roda/plugins/route_csrf.rb

Public Instance methods

check_csrf!(opts=OPTS, &block)

Check that the submitted CSRF token is valid, if the request requires a CSRF token. If the CSRF token is valid or the request does not require a CSRF token, return nil. Otherwise, if a block is given, treat it as a routing block and yield to it, and if a block is not given, use the :csrf_failure option to determine how to handle it.

[show source] 
    # File lib/roda/plugins/route_csrf.rb
224 def check_csrf!(opts=OPTS, &block)
225   if msg = csrf_invalid_message(opts)
226     if block
227       @_request.on(&block)
228     end
229     
230     case failure_action = opts.fetch(:csrf_failure, csrf_options[:csrf_failure])
231     when :raise
232       raise InvalidToken, msg
233     when :empty_403
234       @_response.status = 403
235       headers = @_response.headers
236       headers.clear
237       headers[RodaResponseHeaders::CONTENT_TYPE] = 'text/html'
238       headers[RodaResponseHeaders::CONTENT_LENGTH] ='0'
239       throw :halt, @_response.finish_with_body([])
240     when :clear_session
241       RodaPlugins.warn "Passing :clear_session as the :csrf_failure option to check_csrf! is deprecated"
242       session.clear
243     when :csrf_failure_method
244       @_request.on{_roda_route_csrf_failure(@_request)}
245     when Proc
246       RodaPlugins.warn "Passing a Proc as the :csrf_failure option value to check_csrf! is deprecated"
247       @_request.on{instance_exec(@_request, &failure_action)} # Deprecated
248     else
249       raise RodaError, "Unsupported :csrf_failure option: #{failure_action.inspect}"
250     end
251   end
252 end
csrf_field()

The name of the hidden input tag containing the CSRF token. Also used as the name for the meta tag.

[show source] 
    # File lib/roda/plugins/route_csrf.rb
256 def csrf_field
257   csrf_options[:field]
258 end
csrf_formaction_tag(path, *args)

An HTML hidden input tag string containing the CSRF token, used for inputs with formaction, so the same form can be used to submit to multiple endpoints depending on which button was clicked. See csrf_token for arguments, but the path argument is required.

[show source] 
    # File lib/roda/plugins/route_csrf.rb
294 def csrf_formaction_tag(path, *args)
295   "<input type=\"hidden\" name=\"#{csrf_options[:formaction_field]}[#{Rack::Utils.escape_html(path)}]\" value=\"#{csrf_token(path, *args)}\" \/>"
296 end
csrf_header()

The HTTP header name to use when submitting CSRF tokens in an HTTP header, if such support is enabled (it is not by default).

[show source] 
    # File lib/roda/plugins/route_csrf.rb
262 def csrf_header
263   csrf_options[:header]
264 end
csrf_metatag()

An HTML meta tag string containing a CSRF token that is not request-specific. It is not recommended to use this, as it doesn’t support request-specific tokens.

[show source] 
    # File lib/roda/plugins/route_csrf.rb
268 def csrf_metatag
269   "<meta name=\"#{csrf_field}\" content=\"#{csrf_token}\" \/>"
270 end
csrf_path(action)

Given a form action, return the appropriate path to use for the CSRF token. This makes it easier to generate request-specific tokens without having to worry about the different types of form actions (relative paths, absolute paths, URLs, empty paths).

[show source] 
    # File lib/roda/plugins/route_csrf.rb
276 def csrf_path(action)
277   case action
278   when nil, '', /\A[#?]/
279     # use current path
280     request.path
281   when /\A(?:https?:\/)?\//
282     # Either full URI or absolute path, extract just the path
283     URI.parse(action).path
284   else
285     # relative path, join to current path
286     URI.join(request.url, action).path
287   end
288 end
csrf_tag(*args)

An HTML hidden input tag string containing the CSRF token. See csrf_token for arguments.

[show source] 
    # File lib/roda/plugins/route_csrf.rb
300 def csrf_tag(*args)
301   "<input type=\"hidden\" name=\"#{csrf_field}\" value=\"#{csrf_token(*args)}\" \/>"
302 end
csrf_token(path=nil, method=('POST' if path))

The value of the csrf token. For a path specific token, provide a path argument. By default, it a path is provided, the POST request method will be assumed. To generate a token for a non-POST request method, pass the method as the second argument.

[show source] 
    # File lib/roda/plugins/route_csrf.rb
308 def csrf_token(path=nil, method=('POST' if path))
309   token = SecureRandom.random_bytes(31)
310   token << csrf_hmac(token, method, path)
311   [token].pack("m0")
312 end
use_request_specific_csrf_tokens?()

Whether request-specific CSRF tokens should be used by default.

[show source] 
    # File lib/roda/plugins/route_csrf.rb
315 def use_request_specific_csrf_tokens?
316   csrf_options[:require_request_specific_tokens]
317 end
valid_csrf?(opts=OPTS)

Whether the submitted CSRF token is valid for the request. True if the request does not require a CSRF token.

[show source] 
    # File lib/roda/plugins/route_csrf.rb
321 def valid_csrf?(opts=OPTS)
322   csrf_invalid_message(opts).nil?
323 end