Rails源代码分析（28）：ActionController::RequestForgeryProtection

这是controller的最后一个module:

1 说明

Protecting controller actions from CSRF attacks by ensuring that all forms are coming from the current web application, not a forged link from another site, is done by embedding a token based on the session (which an attacker wouldn't know) in all forms and Ajax requests generated by Rails and then verifying the authenticity of that token in the controller. 

Only HTML/JavaScript requests are checked, so this will not protect your XML API (presumably you'll have a different authentication scheme there anyway).  

Also, GET requests are not protected as these should be indempotent anyway.

This is turned on with the protect_from_forgery method, which will check the token and raise an

ActionController::InvalidAuthenticityToken if it doesn't match what was expected. 

You can customize the error message in production by editing public/422.html.  

A call to this method in ApplicationController is generated by default in post-Rails 2.0 applications.

The token parameter is named <tt>authenticity_token</tt> by default. If you are generating an HTML form manually (without the

use of Rails' <tt>form_for</tt>, <tt>form_tag</tt> or other helpers), you have to include a hidden field named like that and set its value to what is returned by <tt>form_authenticity_token</tt>. Same applies to manually constructed Ajax requests. To make the token available through a global variable to scripts on a certain page, you could add something like this to a view:

    

       <%= javascript_tag "window._token = '#{form_authenticity_token}'" %>

    

Request forgery protection is disabled by default in test environment.  If you are upgrading from Rails 1.x, add this to

    # config/environments/test.rb:

    

       # Disable request forgery protection in test environment

       config.action_controller. allow_forgery_protection = false

1.       # Turn on request forgery protection. Bear in mind that only non-GET, HTML/JavaScript requests are checked.
2.       #
3.       # Example:
4.       #
5.          class FooController < ApplicationController
6.            # uses the cookie session store (then you don't need a separate :secret)
7.            protect_from_forgery :except => :index
8.       
9.            # uses one of the other session stores that uses a session_id value.
10.            protect_from_forgery :secret => 'my-little-pony', :except => :index
11.       
12.            # you can disable csrf protection on controller-by-controller basis:
13.            skip_before_filter :verify_authenticity_token
14.          end
15.       
16.       # Valid Options:
17.       #
18.       # * <tt>:only/:except</tt> - Passed to the <tt>before_filter</tt> call.  Set which actions are verified.
19.       # * <tt>:secret</tt> - Custom salt used to generate the <tt>form_authenticity_token</tt>.
20.       #   Leave this off if you are using the cookie session store.
21.       # * <tt>:digest</tt> - Message digest used for hashing.  Defaults to 'SHA1'.

2 实现

1.   module RequestForgeryProtection
2.     def self.included(base)
3.       base.class_eval do
4.        # 增加了一个options变量,并且设置为空
5.         class_inheritable_accessor :request_forgery_protection_options
6.         self.request_forgery_protection_options = {}
7.         # 增加了两个helper_method
8.         helper_method :form_authenticity_token
9.         helper_method :protect_against_forgery?
10.       end
11.       base.extend(ClassMethods)
12.     end
13.     
14.    
15.     module ClassMethods
16.       
17.       def protect_from_forgery(options = {})
18.         self.request_forgery_protection_token ||= :authenticity_token
19.         # 增加一个before_filter verify_authenticity_token
20.         before_filter :verify_authenticity_token, :only => options.delete(:only), :except => options.delete(:except)
21.         request_forgery_protection_options.update(options)
22.       end
23.     end
25.     protected
26.       # The actual before_filter that is used.  Modify this to change how you handle unverified requests.
27.       def verify_authenticity_token
28.         verified_request? || raise(ActionController::InvalidAuthenticityToken)
29.       end
30.       
31.       # Returns true or false if a request is verified.  Checks:
32.       #
33.       # * is the format restricted?  By default, only HTML and AJAX requests are checked.
34.       # * is it a GET request?  Gets should be safe and idempotent
35.       # * Does the form_authenticity_token match the given _token value from the params?
36.       def verified_request?
37.         !protect_against_forgery?     || # 1 如果不需要保护
38.           request.method == :get      || # 2 如果是get方法
39.           !verifiable_request_format? || # 3 是不是需要验证的格式
40.           form_authenticity_token == params[request_forgery_protection_token] # 4 是不是正确的token
41.       end
42.     
43.       def verifiable_request_format?
44.         request.content_type.nil? || request.content_type.verify_request?
45.       end
46.     
47.       # Sets the token value for the current session.  Pass a <tt>:secret</tt> option
48.       # in +protect_from_forgery+ to add a custom salt to the hash.
49.       def form_authenticity_token
50.         @form_authenticity_token ||= if !session.respond_to?(:session_id) # 没有session_id
51.           raise InvalidAuthenticityToken, "Request Forgery Protection requires a valid session.  Use #allow_forgery_protection to disable it, or use a valid session."
52.         elsif request_forgery_protection_options[:secret] 
53.           authenticity_token_from_session_id # 如果有secret 从session_id中获取token
54.         elsif session.respond_to?(:dbman) && session.dbman.respond_to?(:generate_digest)
55.           authenticity_token_from_cookie_session # 从cookie session中获取token
56.         else
57.           raise InvalidAuthenticityToken, "No :secret given to the #protect_from_forgery call.  Set that or use a session store capable of generating its own keys (Cookie Session Store)."
58.         end
59.       end
60.       
61.       # Generates a unique digest using the session_id and the CSRF secret.
62.       def authenticity_token_from_session_id
63.         key = if request_forgery_protection_options[:secret].respond_to?(:call)
64.           request_forgery_protection_options[:secret].call(@session)
65.         else
66.           request_forgery_protection_options[:secret]
67.         end
68.         digest = request_forgery_protection_options[:digest] ||= 'SHA1'
69.         OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new(digest), key.to_s, session.session_id.to_s)
70.       end
71.       
72.       # No secret was given, so assume this is a cookie session store.
73.       def authenticity_token_from_cookie_session
74.         session[:csrf_id] ||= CGI::Session.generate_unique_id
75.         session.dbman.generate_digest(session[:csrf_id])
76.       end
77.       
78.       def protect_against_forgery?
79.         allow_forgery_protection && request_forgery_protection_token
80.       end
81.   end