module Tennpipes::Helpers::FormHelpers::Security

Helpers to generate form security tags for csrf protection.

Public Instance Methods

csrf_meta_tags() click to toggle source

Constructs meta tags `csrf-param` and `csrf-token` with the name of the cross-site request forgery protection parameter and token, respectively.

@return [String] The meta tags with the CSRF token and the param your app expects it in.

@example

csrf_meta_tags
# File lib/tennpipes-helper/form_helpers/security.rb, line 34
def csrf_meta_tags
  if is_protected_from_csrf?
    meta_tag(csrf_param, :name => 'csrf-param') <<
    meta_tag(csrf_token, :name => 'csrf-token')
  end
end
csrf_token_field() click to toggle source

Constructs a hidden field containing a CSRF token.

@param [String] token

The token to use. Will be read from the session by default.

@return [String] The hidden field with CSRF token as value.

@example

csrf_token_field
# File lib/tennpipes-helper/form_helpers/security.rb, line 21
def csrf_token_field
  hidden_field_tag csrf_param, :value => csrf_token
end

Protected Instance Methods

csrf_param() click to toggle source

Returns the param/field name in which your CSRF token should be expected by your controllers. Defaults to `authenticity_token`.

Set this in your application with `set :csrf_param, :something_else`.

# File lib/tennpipes-helper/form_helpers/security.rb, line 64
def csrf_param
  defined?(settings) && settings.respond_to?(:csrf_param) ? settings.csrf_param : :authenticity_token
end
csrf_token() click to toggle source

Returns the current CSRF token (based on the session). If it doesn't exist, it will create one and assign it to the session's `csrf` key.

# File lib/tennpipes-helper/form_helpers/security.rb, line 54
def csrf_token
  session[:csrf] ||= SecureRandom.hex(32) if defined?(session)
end
is_protected_from_csrf?() click to toggle source

Returns whether the application is being protected from CSRF. Defaults to true.

# File lib/tennpipes-helper/form_helpers/security.rb, line 46
def is_protected_from_csrf?
  defined?(settings) ? settings.protect_from_csrf : true
end