module Roda::RodaPlugins::RouteCsrf::InstanceMethods

  1. lib/roda/plugins/route_csrf.rb

Public Instance methods

check_csrf!(opts=OPTS, &block)

Check that the submitted CSRF token is valid, if the request requires a CSRF token. If the CSRF token is valid or the request does not require a CSRF token, return nil. Otherwise, if a block is given, treat it as a routing block and yield to it, and if a block is not given, use the :csrf_failure option to determine how to handle it.

[show source] 
    # File lib/roda/plugins/route_csrf.rb
220 def check_csrf!(opts=OPTS, &block)
221   if msg = csrf_invalid_message(opts)
222     if block
223       @_request.on(&block)
224     end
225     
226     case failure_action = opts.fetch(:csrf_failure, csrf_options[:csrf_failure])
227     when :raise
228       raise InvalidToken, msg
229     when :empty_403
230       @_response.status = 403
231       headers = @_response.headers
232       headers.clear
233       headers[RodaResponseHeaders::CONTENT_TYPE] = 'text/html'
234       headers[RodaResponseHeaders::CONTENT_LENGTH] ='0'
235       throw :halt, @_response.finish_with_body([])
236     when :clear_session
237       RodaPlugins.warn "Passing :clear_session as the :csrf_failure option to check_csrf! is deprecated"
238       session.clear
239     when :csrf_failure_method
240       @_request.on{_roda_route_csrf_failure(@_request)}
241     when Proc
242       RodaPlugins.warn "Passing a Proc as the :csrf_failure option value to check_csrf! is deprecated"
243       @_request.on{instance_exec(@_request, &failure_action)} # Deprecated
244     else
245       raise RodaError, "Unsupported :csrf_failure option: #{failure_action.inspect}"
246     end
247   end
248 end
csrf_field()

The name of the hidden input tag containing the CSRF token. Also used as the name for the meta tag.

[show source] 
    # File lib/roda/plugins/route_csrf.rb
252 def csrf_field
253   csrf_options[:field]
254 end
csrf_formaction_tag(path, *args)

An HTML hidden input tag string containing the CSRF token, used for inputs with formaction, so the same form can be used to submit to multiple endpoints depending on which button was clicked. See csrf_token for arguments, but the path argument is required.

[show source] 
    # File lib/roda/plugins/route_csrf.rb
290 def csrf_formaction_tag(path, *args)
291   "<input type=\"hidden\" name=\"#{csrf_options[:formaction_field]}[#{Rack::Utils.escape_html(path)}]\" value=\"#{csrf_token(path, *args)}\" \/>"
292 end
csrf_header()

The HTTP header name to use when submitting CSRF tokens in an HTTP header, if such support is enabled (it is not by default).

[show source] 
    # File lib/roda/plugins/route_csrf.rb
258 def csrf_header
259   csrf_options[:header]
260 end
csrf_metatag()

An HTML meta tag string containing a CSRF token that is not request-specific. It is not recommended to use this, as it doesn’t support request-specific tokens.

[show source] 
    # File lib/roda/plugins/route_csrf.rb
264 def csrf_metatag
265   "<meta name=\"#{csrf_field}\" content=\"#{csrf_token}\" \/>"
266 end
csrf_path(action)

Given a form action, return the appropriate path to use for the CSRF token. This makes it easier to generate request-specific tokens without having to worry about the different types of form actions (relative paths, absolute paths, URLs, empty paths).

[show source] 
    # File lib/roda/plugins/route_csrf.rb
272 def csrf_path(action)
273   case action
274   when nil, '', /\A[#?]/
275     # use current path
276     request.path
277   when /\A(?:https?:\/)?\//
278     # Either full URI or absolute path, extract just the path
279     URI.parse(action).path
280   else
281     # relative path, join to current path
282     URI.join(request.url, action).path
283   end
284 end
csrf_tag(*args)

An HTML hidden input tag string containing the CSRF token. See csrf_token for arguments.

[show source] 
    # File lib/roda/plugins/route_csrf.rb
296 def csrf_tag(*args)
297   "<input type=\"hidden\" name=\"#{csrf_field}\" value=\"#{csrf_token(*args)}\" \/>"
298 end
csrf_token(path=nil, method=('POST' if path))

The value of the csrf token. For a path specific token, provide a path argument. By default, it a path is provided, the POST request method will be assumed. To generate a token for a non-POST request method, pass the method as the second argument.

[show source] 
    # File lib/roda/plugins/route_csrf.rb
304 def csrf_token(path=nil, method=('POST' if path))
305   token = SecureRandom.random_bytes(31)
306   token << csrf_hmac(token, method, path)
307   [token].pack("m0")
308 end
use_request_specific_csrf_tokens?()

Whether request-specific CSRF tokens should be used by default.

[show source] 
    # File lib/roda/plugins/route_csrf.rb
311 def use_request_specific_csrf_tokens?
312   csrf_options[:require_request_specific_tokens]
313 end
valid_csrf?(opts=OPTS)

Whether the submitted CSRF token is valid for the request. True if the request does not require a CSRF token.

[show source] 
    # File lib/roda/plugins/route_csrf.rb
317 def valid_csrf?(opts=OPTS)
318   csrf_invalid_message(opts).nil?
319 end