Module: Ramaze::Helper::CSRF

A relatively basic yet useful helper that can be used to protect your application from CSRF attacks/exploits. Note that this helper merely generates the required data, and provides several methods. You still need to manually add the token to each form.

The reason for this is because this is quite simple. Ramaze is meant as a framework that works with any given helper, ORM, template engine and so on. If we were to automatically load this helper and include (a perhaps more advanced) CSRF system that would mean that every form helper, official or third-party, would have to support that specific system. However, there’s no need to panic as it’s very easy to setup a basic anti CSRF system.

Usage

In order to enable CSRF protection we need to do two things. Load the helper and create a before_all block in a controller. Take a look at the following code:

 class BaseController < Ramaze::Controller
   before_all do
     puts "Hello, before_all!"
   end
 end

This would output "Hello, before_all!" to the console upon each request. Not very useful but it does show what the before_all block can do. On to actual CSRF related code!

 class BaseController < Ramaze::Controller
   before_all do
     csrf_protection :save do
       # ....
     end
   end
 end

This example introduces an extra block that validates the current request. Whenever a user requests a controller that either extends BaseController or has it’s own before_all block Ramaze will check if the current request data contains a CSRF token. Of course an if/end isn’t very useful if it doesn’t do anything, let’s add some code.

 class BaseController < Ramaze::Controller
   before_all do
     csrf_protection :save do
       puts "Hello, unsafe data!"
     end
   end
 end

The code above checks if the current method is "save" (or any other of the provided methods) and checks if an CSRF token is supplied if the method matches. Protected methods require a token in ALL HTTP requests (GET, POST, etc). While this may seem weird since GET is generally used for safe actions it actually makes sense. Ramaze stores both the POST and GET parameters in the request.params hash. While this makes it easy to work with POST/GET data this also makes it easier to spoof POST requests using a GET request, thus this helper protects ALL request methods.

If you’re a lazy person you can copy-paste the example below and adapt it to your needs.

 class BaseController < Ramaze::Controller
   before_all do
     csrf_protection :save do
       respond("The supplied CSRF token is invalid.", 401)
     end
   end
 end