Public Instance methods
check_sec_fetch_site!(&block)
Check that the Sec-Fetch-Site header is valid, if the request requires it. If the header is valid or the request does not require the header, return nil. Otherwise, if a block is given, treat it as a routing block and yield to it, and if a block is not given, use the plugin :csrf_failure option to determine how to handle it.
[show source]
# File lib/roda/plugins/sec_fetch_site_csrf.rb 107 def check_sec_fetch_site!(&block) 108 plugin_opts = self.class.sec_fetch_site_csrf_opts 109 return unless plugin_opts[:check_request_methods].include?(request.request_method) 110 111 sec_fetch_site = env["HTTP_SEC_FETCH_SITE"] 112 return if plugin_opts[:allowed_values].include?(sec_fetch_site) 113 114 @_request.on(&block) if block 115 116 case failure_action = plugin_opts[:csrf_failure] 117 when :raise 118 raise CsrfFailure, "potential cross-site request, Sec-Fetch-Site value: #{sec_fetch_site.inspect}" 119 when :empty_403 120 @_response.status = 403 121 headers = @_response.headers 122 headers.clear 123 headers[RodaResponseHeaders::CONTENT_TYPE] = 'text/html' 124 headers[RodaResponseHeaders::CONTENT_LENGTH] ='0' 125 throw :halt, @_response.finish_with_body([]) 126 when :clear_session 127 # RODA4: Remove 128 session.clear 129 else # when :method 130 @_request.on{_roda_sec_fetch_site_csrf_failure(@_request)} 131 end 132 end