CSRF protection in Ruby on Rails - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable CSRF protection in a Rails controller.

Ruby on Rails

class ApplicationController < ActionController::Base
  protect_from_forgery with: [1]
end

Drag options to blanks, or click blank then click option'

A:exception

B:null_session

C:reset_session

D:allow

Attempts:

3 left

💡 Hint

Common Mistakes

Using :null_session disables raising errors and may allow unsafe requests.

Using :allow does not protect against CSRF attacks.

The protect_from_forgery method with :exception option raises an exception on CSRF attacks, which is the default and recommended way in Rails.

2fill in blank

medium

Complete the code to include the CSRF token in a Rails form helper.

Ruby on Rails

<%= form_with url: '/posts' do |form| %>
  [1]
  <%= form.submit 'Create' %>
<% end %>

Drag options to blanks, or click blank then click option'

Aform.hidden_field :authenticity_token, value: form.authenticity_token

Bform.authenticity_token

Ccsrf_meta_tags

Dform.hidden_field :authenticity_token

Attempts:

3 left

💡 Hint

Common Mistakes

Using csrf_meta_tags inside the form does not add the token field.

Using form.authenticity_token alone does not create a form input.

The CSRF token is included as a hidden field with the token value to protect the form submission.

3fill in blank

hard

Fix the error in the controller to skip CSRF protection for API requests.

Ruby on Rails

class ApiController < ActionController::API
  [1] :verify_authenticity_token
end

Drag options to blanks, or click blank then click option'

Aaround_action

Bbefore_action

Cafter_action

Dskip_before_action

Attempts:

3 left

💡 Hint

Common Mistakes

Using before_action adds the check instead of skipping it.

Using after_action or around_action is not correct for skipping CSRF.

To disable CSRF protection for API controllers, use skip_before_action :verify_authenticity_token.

4fill in blank

hard

Complete the code to create a hash of form data including the CSRF token.

Ruby on Rails

form_data = {
  authenticity_token: [1],
  post: { title: 'Hello', content: 'World' },
}

Drag options to blanks, or click blank then click option'

Aform_authenticity_token

Bform_authenticity_token()

C,

D;

Attempts:

3 left

💡 Hint

Common Mistakes

Omitting parentheses on the method call.

Using a semicolon instead of a comma in the hash.

The method form_authenticity_token() returns the CSRF token string. A comma is needed to separate hash entries.

5fill in blank

hard

Fill all three blanks to verify the CSRF token in a custom controller action.

Ruby on Rails

def verify_token
  token = params[[1]]
  if valid_authenticity_token?(session, token) [2]
    render plain: 'Valid token'
  else
    render plain: 'Invalid token', status: [3]
  end
end

Drag options to blanks, or click blank then click option'

A:authenticity_token

B:csrf_token

C403

D422

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong param key like :csrf_token.

Using 422 status code which means unprocessable entity.

The CSRF token parameter is :authenticity_token. The method valid_authenticity_token? returns true or false, so the if condition is correct. The HTTP status code for forbidden is 403.

Practice

1. What is the main purpose of CSRF protection in a Rails application?

easy

A. To prevent unauthorized commands from being executed by malicious websites

B. To speed up database queries

C. To improve the user interface design

D. To encrypt user passwords

Solution

1. Step 1: Understand CSRF meaning

   CSRF stands for Cross-Site Request Forgery, which is an attack where unauthorized commands are sent from a user that the web application trusts.

2. Step 2: Identify CSRF protection goal

   The goal of CSRF protection is to stop these unauthorized commands from malicious websites.

3. Final Answer:

   To prevent unauthorized commands from being executed by malicious websites -> Option A

4. Quick Check:

   CSRF protection = prevent unauthorized commands [OK]

Hint: CSRF stops bad actions from other sites [OK]

Common Mistakes:

• Confusing CSRF with password encryption
• Thinking it speeds up queries
• Assuming it improves UI design

2. Which line of code correctly enables CSRF protection in a Rails controller?

easy

A. use_csrf_token()

B. enable_csrf_protection true

C. csrf_protect = true

D. protect_from_forgery with: :exception

Solution

1. Step 1: Recall Rails CSRF syntax

   Rails uses the method protect_from_forgery with options like :exception to enable CSRF protection.

2. Step 2: Match correct syntax

   Only protect_from_forgery with: :exception is valid Rails syntax to enable CSRF protection.

3. Final Answer:

   protect_from_forgery with: :exception -> Option D

4. Quick Check:

   Enable CSRF = protect_from_forgery [OK]

Hint: Use protect_from_forgery with: :exception [OK]

Common Mistakes:

• Using non-existent methods like enable_csrf_protection
• Assigning variables instead of calling method
• Calling undefined functions like use_csrf_token()

3. Given this Rails form code snippet, what happens if the CSRF token is missing or invalid?

<%= form_with url: '/posts' do |form| %>
  <%= form.text_field :title %>
  <%= form.submit 'Create' %>
<% end %>

medium

A. The form submits successfully without any error

B. Rails raises an ActionController::InvalidAuthenticityToken error

C. The form data is saved but with a warning in logs

D. The form redirects to the home page silently

Solution

1. Step 1: Understand form_with and CSRF token

   Rails automatically includes a CSRF token in forms created with helpers like form_with.

2. Step 2: Effect of missing or invalid token

   If the token is missing or invalid, Rails raises an ActionController::InvalidAuthenticityToken error to block the request.

3. Final Answer:

   Rails raises an ActionController::InvalidAuthenticityToken error -> Option B

4. Quick Check:

   Missing CSRF token = InvalidAuthenticityToken error [OK]

Hint: Missing token causes InvalidAuthenticityToken error [OK]

Common Mistakes:

• Assuming form submits without error
• Thinking data saves with warning
• Believing it redirects silently

4. You see this error in your Rails app: ActionController::InvalidAuthenticityToken. Which fix will most likely solve the problem?

medium

A. Ensure your forms include the CSRF token by using Rails form helpers

B. Remove the CSRF token from your forms

C. Add protect_from_forgery with: :exception in ApplicationController

D. Disable CSRF protection in config

Solution

1. Step 1: Identify cause of InvalidAuthenticityToken

   This error happens when the CSRF token is missing or invalid in the form submission.

2. Step 2: Choose fix to include CSRF token

   Using Rails form helpers like form_with automatically includes the CSRF token, fixing the error.

3. Final Answer:

   Ensure your forms include the CSRF token by using Rails form helpers -> Option A

4. Quick Check:

   Fix InvalidAuthenticityToken = include CSRF token [OK]

Hint: Use Rails form helpers to add CSRF token automatically [OK]

Common Mistakes:

• Adding protect_from_forgery again when already present
• Removing CSRF token which causes error
• Disabling protection instead of fixing token

5. You want to allow JSON API requests in your Rails app without CSRF errors but keep protection for HTML forms. Which is the best way to do this?

hard

A. Manually add CSRF tokens to JSON requests

B. Disable CSRF protection globally

C. Use protect_from_forgery with: :null_session and handle API authentication separately

D. Use protect_from_forgery with: :exception and skip CSRF check for JSON requests

Solution

1. Step 1: Understand CSRF and API requests

   CSRF tokens are mainly for browser forms; API JSON requests often don't use them and need different handling.

2. Step 2: Choose best Rails approach

   Using protect_from_forgery with: :null_session disables CSRF exceptions for APIs but keeps protection for forms, requiring separate API authentication.

3. Final Answer:

   Use protect_from_forgery with: :null_session and handle API authentication separately -> Option C

4. Quick Check:

   API JSON + CSRF = null_session + separate auth [OK]

Hint: Use null_session for APIs, keep exception for forms [OK]

Common Mistakes:

• Disabling CSRF protection globally
• Trying to add CSRF tokens manually to JSON
• Skipping CSRF only without alternative auth