Home/ Questions/Q 3323202
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-17T23:16:26+00:00

I use Rails request_forgery_protection mechanism to protect my POST actions from CSRF attacks and

  • 0

I use Rails request_forgery_protection mechanism to protect my POST actions from CSRF attacks and captcha to protect the GET actions. This way if someone stages a two-phase attack within one session, GET-ting the form with the current token and then POST-ing a forged request with that token, he will eventually be faced with a captcha check.

I’m stuck with that though, because Rails doesn’t regenerate the CSRF token until the end of session. That doesn’t seem right to me, I’d think the token should be renewed before the next action. I’m wondering maybe I have tweaked something wrong? Is there another way of doing this?

Thanks.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    In case form token is NOT regenerated for each page request, this protection is bad. I faced it sometime ago (when testing Redmine, which is RoR-based) and reported this issue, but didn’t retested it.

    If it’s still not regenerated, I suggest you report this to RoR team.

    • 0