Manual implementation of Csrf Protection?

Rafa_F · July 24, 2015, 7:59am

I am implementing the code in this faye pub/sub
tutorial(Faye: Simple pub/sub messaging for the web) – go to the
example
rails section to see the code I am talking about.

What it does is when a message is to be published, it goes through the
CsrfProtection class. Session_token comes from the csrf_token rails
stores
in a session, and the message_token comes from the tag
authenticity
token in the html code that is extracted by javascript and passed to the
CsrfProtection class as a message_token.

This code always seems to produce an error because the authenticity
token
in the html of the site, is different from the stored csrf_token in
rails.

After inspecting this, I realized that the rails actually encrypts and
decrypts tokens, and so to properly compare the authenticity token with
the
csrf_token in session, one has to first decrypt it.
There should be a rails method that allows you to manually compare the
csrf_token with the authenticity token so one can secure pub/sub
channels
(and to my knowledge, publishing to a pub/sub channel doesn’t go through
a
rails action, and so one can’t use the protect_from_forgery thing).

Thoughts on this? What is the way to protect the pub/sub channel from
csrf
protection?

github.com

rails/rails/blob/e7feaff70f13b56a0507e9f4dfaf3ebc361cb8e6/actionpack/lib/action_controller/metal/request_forgery_protection.rb#L197


      
          # The actual before_action that is used to verify the CSRF token.
          # Don't override this directly. Provide your own forgery protection
          # strategy instead. If you override, you'll disable same-origin
          # `<script>` verification.
          #
          # Lean on the protect_from_forgery declaration to mark which actions are
          # due for same-origin request verification. If protect_from_forgery is
          # enabled on an action, this before_action flags its after_action to
          # verify that JavaScript responses are for XHR requests, ensuring they
          # follow the browser's same-origin policy.
          def verify_authenticity_token
            mark_for_same_origin_verification!
          
          
  if !verified_request?
              if logger && log_warning_on_csrf_failure
                logger.warn "Can't verify CSRF token authenticity"
              end
              handle_unverified_request
            end
          end