gitlab-org--gitlab-foss/lib/gitlab/request_forgery_protection.rb

36 lines
777 B
Ruby
Raw Normal View History

# frozen_string_literal: true
2017-06-21 02:52:54 -04:00
# A module to check CSRF tokens in requests.
# It's used in API helpers and OmniAuth.
# Usage: GitLab::RequestForgeryProtection.call(env)
2017-06-22 01:19:14 -04:00
module Gitlab
2015-12-08 08:41:19 -05:00
module RequestForgeryProtection
class Controller < ActionController::Base
protect_from_forgery with: :exception, prepend: true
2015-12-08 08:41:19 -05:00
def index
head :ok
end
end
2015-12-08 08:41:19 -05:00
def self.app
@app ||= Controller.action(:index)
end
2015-12-08 08:41:19 -05:00
def self.call(env)
app.call(env)
end
def self.verified?(env)
minimal_env = env.slice('REQUEST_METHOD', 'rack.session', 'HTTP_X_CSRF_TOKEN')
.merge('rack.input' => '')
call(minimal_env)
true
rescue ActionController::InvalidAuthenticityToken
false
end
end
end