Prevented attack |
CSRF |
Supported browsers |
all |
More infos |
JSON GET APIs are vulnerable to being embedded as JavaScript while the Array prototype has been patched to track data. Checks the referrer even on GET requests if the content type is JSON.
# File lib/rack/protection/json_csrf.rb, line 16 def call(env) request = Request.new(env) status, headers, body = app.call(env) if has_vector? request, headers warn env, "attack prevented by #{self.class}" react(env) else [status, headers, body] end end
# File lib/rack/protection/json_csrf.rb, line 28 def has_vector?(request, headers) return false if request.xhr? return false unless headers['Content-Type'].to_s.split(';', 2).first =~ /^\s*application\/json\s*$/ origin(request.env).nil? and referrer(request.env) != request.host end
Generated with the Darkfish Rdoc Generator 2.