CSRF protection in Ruby on Rails - Step-by-Step Execution

Concept Flow - CSRF protection

User sends form request

↓

Rails adds CSRF token to form

↓

User submits form with token

↓

Rails receives request

↓

Check token validity

↓

Process

↓

Action done

Rails adds a secret token to forms and checks it on submission to stop fake requests from other sites.

Execution Sample

Ruby on Rails

class PostsController < ApplicationController
  protect_from_forgery with: :exception

  def create
    # create post logic
  end
end

This code enables CSRF protection in a Rails controller, raising an error if the token is missing or wrong.

Execution Table

Step	Action	Token Present?	Token Valid?	Result
1	Render form	N/A	N/A	Form includes CSRF token hidden field
2	User submits form	Yes	Yes	Request accepted, post created
3	User submits form	No	N/A	Request rejected, raises exception
4	User submits form	Yes	No	Request rejected, raises exception

💡 Execution stops when request is accepted or rejected based on token check

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4
csrf_token	nil	generated token string	submitted token string (valid)	nil	submitted token string (invalid)
request_status	pending	pending	accepted	rejected	rejected

Key Moments - 3 Insights

Why does Rails add a hidden token field to forms?

Rails adds the hidden token so it can verify the request came from the same site, as shown in Step 1 of the execution_table.

What happens if the token is missing in the submitted form?

The request is rejected and an exception is raised, as shown in Step 3 of the execution_table.

How does Rails know if the token is valid or not?

Rails compares the submitted token with the one stored in the user session, rejecting the request if they don't match, as shown in Step 4.

Visual Quiz - 3 Questions

Look at the execution_table, what happens at Step 2 when the token is present and valid?

A Form is re-rendered with a new token

B Request is rejected with an error

C Request is accepted and post is created

D User is redirected to login

💡 Hint

Check the Result column in Step 2 of the execution_table

At which step does the request get rejected because the token is missing?

A Step 3

B Step 1

C Step 2

D Step 4

💡 Hint

Look for 'Token Present?' column with 'No' in the execution_table

If the token submitted does not match the stored token, what is the result?

A Request accepted

B Request rejected with exception

C Token is regenerated automatically

D Form is submitted twice

💡 Hint

See Step 4 in the execution_table where Token Valid? is 'No'

Concept Snapshot

Rails CSRF protection:
- Adds a hidden token to forms automatically
- Checks token on form submission
- Rejects requests with missing or invalid tokens
- Enabled by protect_from_forgery in controllers
- Stops attackers from forging requests
- Raises exception on failure

Full Transcript

CSRF protection in Rails works by adding a secret token to forms when they are rendered. When the user submits the form, Rails checks if the token is present and matches the one stored in the session. If the token is valid, the request is processed normally. If the token is missing or invalid, Rails rejects the request and raises an exception. This prevents attackers from tricking users into submitting unwanted requests from other sites. The key steps are rendering the form with the token, submitting the form, and verifying the token on the server side.