CSRF protection in Ruby on Rails - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a Rails form is submitted without a CSRF token?

Consider a Rails application with default CSRF protection enabled. What will happen if a form is submitted without including the CSRF token?

A The server will reject the request with an <strong>ActionController::InvalidAuthenticityToken</strong> error.

B The server will accept the request and process it normally without any error.

C The server will redirect the user to the login page automatically.

D The server will log a warning but still process the request.

💡 Hint

Think about what Rails does to protect against forged requests.

Rails raises an ActionController::InvalidAuthenticityToken error when the CSRF token is missing or invalid to prevent cross-site request forgery attacks.

📝 Syntax

intermediate

Which code snippet correctly includes the CSRF token in a Rails form?

In Rails views, which code snippet correctly ensures the CSRF token is included in the form?

A <code>&lt;form&gt;&lt;input type='hidden' name='csrf_token' value='&lt;%= csrf_token %&gt;'&gt;&lt;/form&gt;</code>

B <code>&lt;form&gt;&lt;%= csrf_meta_tags %&gt;&lt;/form&gt;</code>

C <code>&lt;%= form_with model: @post do |form| %&gt;&lt;/form&gt;</code>

D <code>&lt;form&gt;&lt;input type='hidden' name='authenticity_token' value='&lt;%= form_authenticity_token %&gt;'&gt;&lt;/form&gt;</code>

💡 Hint

Look for the correct hidden input name and method to get the token.

The hidden input must have the name authenticity_token and the value from form_authenticity_token. The csrf_meta_tags helper adds meta tags, not form inputs. The form_with helper automatically includes the token but the question asks for explicit code snippet.

🔧 Debug

advanced

Why does disabling CSRF protection cause a security risk?

A developer disables CSRF protection in a Rails controller using skip_before_action :verify_authenticity_token. What is the main security risk introduced?

A The application will crash when receiving POST requests.

B Attackers can trick users into submitting unwanted requests on their behalf, potentially changing data without consent.

C Users will be logged out automatically after each request.

D The server will reject all AJAX requests.

💡 Hint

Think about what CSRF protection prevents.

Disabling CSRF protection allows attackers to perform cross-site request forgery attacks, where they trick authenticated users into submitting malicious requests without their knowledge.

🧠 Conceptual

advanced

How does Rails verify the CSRF token on incoming requests?

Which statement best describes how Rails verifies the CSRF token on POST, PATCH, PUT, or DELETE requests?

A Rails verifies the token by decoding a JWT sent in the request headers.

B Rails checks if the token matches a value stored in a cookie named <code>csrf_token</code>.

C Rails compares the token submitted in the form data or headers with the token stored in the user session.

D Rails does not verify tokens on non-GET requests by default.

💡 Hint

Consider where Rails stores the token and how it compares it.

Rails stores the CSRF token in the user session and compares it with the token submitted in the form or headers to verify authenticity.

❓ state_output

expert

What is the value of session[:_csrf_token] after a valid form submission?

Given a Rails app with default CSRF protection, after a user submits a valid form with a correct CSRF token, what happens to session[:_csrf_token]?

A It remains the same as before the request, preserving the token for future requests.

B It is cleared and set to <code>nil</code> after each valid request.

C It changes to a new random token after each valid form submission.

D It stores the submitted token value from the form for the current request only.

💡 Hint

Think about token reuse and session persistence.

Rails keeps the CSRF token in the session unchanged across requests to allow multiple valid form submissions without regenerating the token each time.