CSRF protection in Ruby on Rails - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does CSRF stand for and what problem does it solve?

CSRF stands for Cross-Site Request Forgery. It protects web applications by preventing unauthorized commands from being transmitted from a user that the web app trusts.

beginner

How does Rails protect against CSRF attacks by default?

Rails includes a CSRF token in forms and verifies this token on the server for each non-GET request. If the token is missing or invalid, Rails rejects the request.

intermediate

What is the purpose of the protect_from_forgery method in Rails?

The protect_from_forgery method enables CSRF protection in Rails controllers by checking the CSRF token on requests that change data.

intermediate

Why should CSRF tokens be unique per user session?

Unique tokens per session ensure that attackers cannot guess or reuse tokens from other users, making CSRF attacks much harder to perform.

advanced

How can you disable CSRF protection for specific actions in a Rails controller?

You can disable CSRF protection for specific actions by using skip_before_action :verify_authenticity_token, only: [:action_name] in the controller.

What does Rails check to protect against CSRF attacks?

A User's browser type

B User's IP address

C A secret token included in forms and headers

D The request URL

Rails uses a secret CSRF token included in forms and headers to verify requests.

Which HTTP methods does Rails typically protect with CSRF tokens?

A POST, PUT, PATCH, DELETE

B All HTTP methods

C OPTIONS only

D GET and HEAD

Rails protects state-changing methods like POST, PUT, PATCH, and DELETE with CSRF tokens.

What happens if a CSRF token is missing or invalid in a Rails request?

A The user is redirected to the homepage

B The request is processed normally

C Rails logs a warning but processes the request

D Rails raises an exception and rejects the request

Rails raises an exception and rejects requests with missing or invalid CSRF tokens.

How can you include a CSRF token in an HTML form in Rails views?

A Manually add a hidden input with the token

B Use Rails form helpers like <code>form_with</code> or <code>form_for</code>

C Add a meta tag in the head

D No need to include it in forms

Rails form helpers automatically include the CSRF token as a hidden field.

When might you want to disable CSRF protection in a Rails controller?

A For API endpoints that use other authentication methods

B For all user-facing forms

C For GET requests

D Never disable CSRF protection

API endpoints often disable CSRF protection because they use tokens or other methods for security.

Explain how Rails uses CSRF tokens to protect web applications from attacks.

Think about what Rails adds to forms and checks on the server.

Describe how you can manage CSRF protection in a Rails controller, including enabling and disabling it.

Consider controller methods that control CSRF checks.