XSS issue

pankaj
Thu, 18 Sep 2008 20:08:59 -0000

To prevent XSS attack rails generates an authenticity_token for every
form.
This token has to be present in with every request other then
''ge''t.
I have noticed that this token is same accross the application..i
think for a particular session..
This token can be extracted by javascript and a new create/update/
delete request can be successfully executed.
Then authentication_token is of no use.
Correct me if I am wrong?

Regards,
Pankaj