Home/ Questions/Q 7744315
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-01T09:44:19+00:00

I’m a PHP developer learning Ruby on Rails by reading Michael Hartl’s tutorial .

  • 0

I’m a PHP developer learning Ruby on Rails by reading Michael Hartl’s tutorial. Here is a quote from the book, referring to csrf_meta_tag:

…the Rails method csrf_meta_tag [prevents] cross-site request
forgery (CSRF), a type of malicious web attack. Don’t worry about the
details (I don’t); just know that Rails is working hard to keep your
application secure.

The thing is, I’m genuinely curious. How does inserting csrf-param and csrf-token meta tags prevent CSRF? I tried Googling, but couldn’t find anything.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    csrf_meta_tag is basically fulfilling the same thing as hidden form fields but is there to give javascript requests that aren’t tied to a form an easy way of getting the token.

    If you use the jquery-ujs library the content of that meta tag is automatically added (as a request header) to any ajax requests made.

    • 0