search

varvet / pundit

Minimal authorization through OO design and pure Ruby classes
MIT License
8.29k stars 632 forks source link

docs: remove `protect_from_forgery` from examples #651

Closed tomholford closed 4 years ago

tomholford commented 4 years ago

Per https://github.com/rails/rails/commit/ec4a836919c021c0a5cf9ebeebb4db5e02104a55 on July 11, 2017, protect_from_forgery is now enabled by default in all Rails applications (5.2+). Thus, this change simplifies the README guide by removing the extraneous method call.

See this issue for additional discussion: https://github.com/rails/rails/issues/29193

This will hopefully prevent someone from doing what I just did in a Rails 6 project:

  1. Following the README to set up pundit, and on Step 1 was looking for the protect_from_forgery method call in ApplicationController
  2. Noticed there was no call to this method, and had a momentary panic about the security of the application
  3. Found the aforementioned commit and breathed a sigh of relief :)

edit Adding a link to the Rails docs that confirms this behavior:

https://edgeguides.rubyonrails.org/configuring.html#configuring-action-controller