6fef87f17f
Since Rails 5.0 the `protect_from_forgery` callback doesn't run first by
default anymore. [1]
Instead it gets inserted into callbacks chain where callbacks get
called in order.
This commit forces the callback to run first.
[1]: 3979403781
39 lines
1 KiB
Ruby
39 lines
1 KiB
Ruby
# A module to check CSRF tokens in requests.
|
|
# It's used in API helpers and OmniAuth.
|
|
# Usage: GitLab::RequestForgeryProtection.call(env)
|
|
|
|
module Gitlab
|
|
module RequestForgeryProtection
|
|
class Controller < ActionController::Base
|
|
protect_from_forgery with: :exception, prepend: true
|
|
|
|
rescue_from ActionController::InvalidAuthenticityToken do |e|
|
|
logger.warn "This CSRF token verification failure is handled internally by `GitLab::RequestForgeryProtection`"
|
|
logger.warn "Unlike the logs may suggest, this does not result in an actual 422 response to the user"
|
|
logger.warn "For API requests, the only effect is that `current_user` will be `nil` for the duration of the request"
|
|
|
|
raise e
|
|
end
|
|
|
|
def index
|
|
head :ok
|
|
end
|
|
end
|
|
|
|
def self.app
|
|
@app ||= Controller.action(:index)
|
|
end
|
|
|
|
def self.call(env)
|
|
app.call(env)
|
|
end
|
|
|
|
def self.verified?(env)
|
|
call(env)
|
|
|
|
true
|
|
rescue ActionController::InvalidAuthenticityToken
|
|
false
|
|
end
|
|
end
|
|
end
|