debian-mirror-gitlab/lib/gitlab/request_forgery_protection.rb

42 lines
1.1 KiB
Ruby
Raw Normal View History

2018-12-13 13:39:08 +05:30
# frozen_string_literal: true
2017-09-10 17:25:29 +05:30
# A module to check CSRF tokens in requests.
# It's used in API helpers and OmniAuth.
# Usage: GitLab::RequestForgeryProtection.call(env)
module Gitlab
module RequestForgeryProtection
class Controller < ActionController::Base
2018-11-08 19:23:39 +05:30
protect_from_forgery with: :exception, prepend: true
2017-09-10 17:25:29 +05:30
rescue_from ActionController::InvalidAuthenticityToken do |e|
logger.warn "This CSRF token verification failure is handled internally by `GitLab::RequestForgeryProtection`"
logger.warn "Unlike the logs may suggest, this does not result in an actual 422 response to the user"
logger.warn "For API requests, the only effect is that `current_user` will be `nil` for the duration of the request"
raise e
end
def index
head :ok
end
end
def self.app
@app ||= Controller.action(:index)
end
def self.call(env)
app.call(env)
end
def self.verified?(env)
call(env)
true
rescue ActionController::InvalidAuthenticityToken
false
end
end
end