search

janko / rodauth-rails

Rails integration for Rodauth authentication framework
https://github.com/jeremyevans/rodauth
MIT License
599 stars 40 forks source link

Use Rodauth's new #check_csrf method for CSRF protection #4

Closed janko closed 4 years ago

janko commented 4 years ago

This makes CSRF protection with Rails follow the same rules as when using Roda directly, meaning users can do things like override #check_csrf? to skip CSRF protection for certain routes, and that will now work correctly with rodauth-rails. The rodauth-oauth gem is one example where CSRF protection needs to be skipped for some routes.

We first need to wait for https://github.com/jeremyevans/rodauth/pull/96 to be merged, which adds the #check_csrf method.

Closes #2

/cc @HoneyryderChuck

HoneyryderChuck commented 4 years ago

LGTM, thx for the change!