rails/rails — Issue #5300: XSRF protection should throw exception on failure by default
Author: meder
Created: 2012-03-06 04:26:16+00:00
State: open

Currently XSRF protection resets session and lets the request through when XSRF token verification fails, which by itself is an XSRF vulnerability since it allows anyone to logout users by directing their browser to a page that requires XSRF protection.

One approach proposed by @NZKoz was to have protect_from_forgery accept :with option, e.g.:

protect_from_forgery :with => :exception
protect_from_forgery :with => :null_session

with :exception hopefully being the default.

CC: @NZKoz @igrigorik @ratnikov