8d57d45ecc
* Rubocop enabled style/alias * Enabled Style/ArrayJoin Cop * Enabled Style/Attr * Enabled Case Equality * Enabled CharacterLiteral * Enabled ColonMethodCall Cop * Enabled CommentAnnotation cop * Enabled PreferredHashMethods Cop * Enabled DoubleNegation Cop * Enabled EachWithObject Cop * Enabled EmptyLiteral Cop * Enabled EvenOdd Cop * Enabled IfWithSemicolon Cop * Enabled Lambda and LambdaCall Cop * Enabled LineEndConcatenation Cop * Enabled ModuleFunction Cop; * Enable NegatedIf and NegatedWhile Cop * Enabled NilComparison Cop * Enabled Not Cop * Enabled NumericLiterals Cop * Enabled OneLineConditional Cop * Enabled PercentLiteralDelimiters Cop * Excluded internal/users_controller from negated_if cop * Reverted the double negation change from github_issue_tag and github_issue.rb" * Enabled PerlBackrefs Cop * Changed Regexp.last_match(1) to Regexp.last_match(0) * Enabled proc cop * Enabled RaiseArgs Cop * Reverted Regexp.last_match(0) to Regexp.last_match(1) * Enabled SelfAssignment Cop * Enabled SingleLineMethods Cop * Enabled SpecialGlobalVars Cop * Enabled VariableInterpolation Cop * Enabled WhenThen Cop * Enabled WhileUntilModifier Cop * Enabled WordArray Cop * Enabled IfUnlessModifier Cop * Enabled GuardClause Cop
38 lines
1.5 KiB
Ruby
38 lines
1.5 KiB
Ruby
# config/initializers/monkey_patches/persistent_csrf_token_cookie.rb
|
|
#
|
|
# Workaround for CSRF protection bug.
|
|
#
|
|
# https://github.com/rails/rails/issues/21948
|
|
# The bug:
|
|
# The rails session cookie is not persistent,
|
|
# therefore it expires when the page is loaded from cache
|
|
# (i.e. when browser restores tabs on restart https://www.youtube.com/watch?v=bKDu0qMT4HM)
|
|
# which leads to an `InvalidAuthenticityToken` when the user submits a form from that page.
|
|
#
|
|
# Workaround:
|
|
# We decided to move the CSRF token from the session cookie into a separate persistent cookie.
|
|
module ActionController
|
|
module RequestForgeryProtection
|
|
COOKIE_NAME = :_csrf_token
|
|
|
|
def real_csrf_token(session)
|
|
csrf_token = cookies.encrypted[COOKIE_NAME] || session[:_csrf_token]
|
|
csrf_token ||= SecureRandom.base64(AUTHENTICITY_TOKEN_LENGTH)
|
|
cookies.encrypted[COOKIE_NAME] ||= {
|
|
value: csrf_token,
|
|
expires: 1.year.from_now,
|
|
httponly: true
|
|
}
|
|
session[:_csrf_token] = csrf_token
|
|
Base64.strict_decode64(csrf_token)
|
|
end
|
|
end
|
|
end
|
|
|
|
# http://blog.plataformatec.com.br/2013/08/csrf-token-fixation-attacks-in-devise/
|
|
# (devise-4.2.0/lib/devise/hooks/csrf_cleaner.rb):
|
|
Warden::Manager.after_authentication do |_record, warden, _options|
|
|
clean_up_for_winning_strategy = !warden.winning_strategy.respond_to?(:clean_up_csrf?) ||
|
|
warden.winning_strategy.clean_up_csrf?
|
|
warden.cookies.delete(ActionController::RequestForgeryProtection::COOKIE_NAME) if Devise.clean_up_csrf_token_on_authentication && clean_up_for_winning_strategy
|
|
end
|