Displaying 20 results from an estimated 2000 matches similar to: "CSRF protection not working with jquery ajax post request"
2010 Jul 08
2
rspec-rails how to selectively turn on csrf protection for controller specs?
I''m setting up a Paypal IPN listener and need the create action to not
use rails'' default CSRF protection.
I''ve got that working fine & test it actually works with cucumber
(where I''ve turned CSRF back on, since it''s full-stack testing) but
would like my controller spec to mention the need for
protect_from_forgery :except => [:create] (and fail
2011 May 25
1
trouble using jQuery in Rails 3.0.7
I''ve tried to install JQuery a couple of times now, and I''ve followed
the steps for Rails UJS mentioned here:
https://github.com/rails/jquery-ujs
The last time I went ahead and added jQuery UI as well:
$ rails generate jquery:install --ui
remove public/javascripts/prototype.js
remove public/javascripts/effects.js
remove public/javascripts/dragdrop.js
2014 May 03
0
Putting form_authenticity_token (csrf token) in a cookie instead of in meta tags?
When you generate a default Rails app, it puts this in
application.html.erb:
<%= csrf_meta_tags %>
It does this so the remote forms can be submitted--i.e., so JavaScript can
submit a form. When jquery-rails is about to submit a form, it looks for
the <meta> tags named "csrf-param" and "csrf-token" and from them it
constructs a hidden
2013 Jan 09
4
CSRF resets my session in Firefox
Hello all,
I''ve been trying to diagnose an issue with CSRF and Firefox
specifically. I''ve got an ajax based form, using UJS (yes, I have
csrf_meta_tag in my layout and I''ve tried adding the X-CSRF-Token header
to the ajax beforeSend events without any luck)... The form just posts
some data to an ajax method that creates, saves, and sets the session
for a shopper as
2009 Oct 17
3
Security problems with CookieStore and CSRF protection
Dear Rails community,
As part of a programming languages/security research group at the
University of Maryland, we are building some static analysis tools for
Rails applications. These tools work by taking formally specified
properties of interest, and then analyzing code to verify that those
properties indeed hold. Using these tools, we found some security
vulnerabilities in Rails, and we would
2011 Aug 10
3
javascript_include_tag error
<!DOCTYPE html>
<html>
<head>
<title><%= @title %></title>
<%= csrf_meta_tag %>
<%= javascript_include_tag
"http://ajax.googleapis.com/ajax/libs/jquery/1.6.2/jquery.min.js",
"jquery.rails.js"
%>
<script type="text/javascript">
...app/views/layouts/application.html.erb:7: syntax error, unexpected
2013 Jan 16
0
Rails 3.2 jQuery JSONP request not working - Moved Permanently
I am trying to send a POST request ( ''remove_tag_named'' )and getting a
simple OK back on success ; it doesn''t work..
the post is correctly sent , but after then it''s looping on sending a GET
request to the same url, with the error
301 Moved Permanently
I should not be far fro the solution, but I am stuck :
In my routes.rb
*namespace
2013 Mar 24
6
forgery protection for multiple browser tabs
Hi,
http://apidock.com/rails/ActionController/RequestForgeryProtection only
maintains one CSRF token at a time. When a user visits some site, he gets a
new token in the session. He then might open a linked site of the same
rails app in a new browser tab (maybe some info he''d like to read), and
again he will get a new token. Then he changes to the first tab again and
submits a form
2011 Feb 09
2
CSRF Protection Bypass in Ruby on Rails - I don't get it ...
Hi all,
My team and I are finding ourselves a little in the dark about the
"CSRF Protection Bypass in Ruby on Rails" vulnerability that was
announced yesterday - http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails
1. Where is the complete Advisory? The Impact section is very unclear.
Looking at the comment in the 2.3 patch mentions "Flash animations and
2010 Apr 01
4
POST-only logic in protect_from_forgery considered harmful?
Hi folks,
I am just getting into rails again after a multi-year stint of
mod_perl jobs, which might grant me some newbie-indemnity for the time
being - but I''ve found an issue I think warrants discussion.
As discussed here - http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html
- the CSRF protection feature does not kick in for GET requests. This
2013 Jan 22
2
Rails 4: Should a HEAD request not be handled like a GET for CSRF protection?
I am running a Rails 4 app in semi-production and I constantly get
exceptions from crawler bots that use a HEAD HTTP method, which causes the
CSRF protection to kick in.
Shouldn''t HEAD requests normally be handled like GET requests?
I am not sure if I''m just being stupid or that hit is a bug somewhere.
Michiel
--
You received this message because you are subscribed to the
2011 Jul 26
1
[Announce] Samba 3.5.10, 3.4.14 and 3.3.16 Security Releases Available
Release Announcements
=====================
Samba 3.5.10, 3.4.14 and 3.3.16 are security releases in order to
address CVE-2011-2522 (Cross-Site Request Forgery in SWAT) and
CVE-2011-2694 (Cross-Site Scripting vulnerability in SWAT).
o CVE-2011-2522:
The Samba Web Administration Tool (SWAT) in Samba versions
3.0.x to 3.5.9 are affected by a cross-site request forgery.
o CVE-2011-2694:
2011 Jul 26
1
[Announce] Samba 3.5.10, 3.4.14 and 3.3.16 Security Releases Available
Release Announcements
=====================
Samba 3.5.10, 3.4.14 and 3.3.16 are security releases in order to
address CVE-2011-2522 (Cross-Site Request Forgery in SWAT) and
CVE-2011-2694 (Cross-Site Scripting vulnerability in SWAT).
o CVE-2011-2522:
The Samba Web Administration Tool (SWAT) in Samba versions
3.0.x to 3.5.9 are affected by a cross-site request forgery.
o CVE-2011-2694:
2011 Feb 11
11
CSRF protection in rails 2.3.11
Hi all,
I think CSFR protection broke in rails 2.3.11.
As in: it''s turned off now.
I tried this in rails 2.3.10 and in 2.3.11 and 2.3.11 seems broken.
>rails csrftest
>cd csrftest
>script/generate scaffold post title:string
>rake db:migrate
now I visit /posts/new in my browser, use firebug to delete or change
the authenticity token, and submit the form.
rails 2.3.11: all
2008 Jan 23
2
CSRF / cached authenticity tokens / ajax requests
I''m going to go out on a limb here and say the new CSRF protection in
Rails is flawed. Why? Forget about caching if you care to use it.
Consider the following:
<% cache do %>
<%= link_to_remote "Add To Favorites", :url => {:controller =>
"favorites", :action => "create", "movie_id" => 2} %>
<% end %>
# Output
<a
2007 Oct 23
6
Auto complete plugin and CSRF protection-- do you care?
Hi,
I just noticed that the auto_complete plugin does not work with the
CSRF protection in Rails 2.0. I''ve patched the plugin, but I''m
wondering if people would like to see the official plugin fixed. If
so, speak up and I will write some tests and submit the patch.
Krishna
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are
2008 May 08
1
disabling forgery protection
Hi,
I have to enable batch uploads to my website with CURL and forgery
protection in ApplicationController is standing in my way. I do use
the restful authentication plugin and I do call login_required on all
actions. Should I keep forgery protection around?
Forgery protection only makes sure that the client request has
originated from client''s session, right? Is there anything else
2011 Aug 28
1
Page Caching, CSRF, and Loading a form via Ajax
Hi all,
I would like to use page caching on my homepage, but also want to
enable people to sign in via a modal dialog sign in form. I could
have a setup in which when a user lands on the cached homepage, an
Ajax GET request pulls in the whole login form so that there is a
fresh authenticity token.
That said, besides the additional hit to the server, the CSRF token in
the head area of the page
2005 May 12
1
Cross-site Request Forgery
Hi all,
I stuck a little bit of information on CSRF on the wiki
(http://wiki.rubyonrails.com/rails/show/HowToAvoidCrossSiteRequestForgery)
and created a "Security Concerns" page from the home page
(http://wiki.rubyonrails.com/rails/show/Security+Concerns) - it would
be good to have a single point of information for all know security
holes and fixes (even if they aren''t Rails
2009 Jun 09
3
protect_from_forgery doesnt protect from forgery
Maybe I am grasping the full usage of this protect_from_forgery
function, but it does not seem to work for me. Imagine the following:
A simple website with a user that needs to log in to do certain stuff
and a closed off admin section that only certain users can access that
have the is_admin field set to true.
So to be clear, my User model has a login, password and is_admin.
When displaying the