This project is archived and is in readonly mode.
authenticity_token appears in URLs after AJAX GET request
If you create an AJAX request via remote_function and specify GET as the method, the authenticity_token parameter is added even though it isn't needed. Consequently, the authenticity_token appears in some URLs such as pagination links on the following page.
This patch ensures that the parameter is not added for GET requests. It checks against js_options rather than options to avoid the confusion surrounding method_option_to_s.
This has been tested with edge and 2.0.2.
-
authenticity-token-ajax-get.diff
644 Bytes
-
Sean Ouimet+1 ... had some code already close to doing this. did a before and after with applying this change and it is confirmed to remove the unnecessary token
The only annoyance was git didn't like applying the patch because of a lack of a valid email address
-
James Le CuirotNot sure what you mean but if you need my address, it's chewi@aura-online.co.uk.
-
Sean Ouimet
$ git am < ~/Desktop/authenticity-token-ajax-get.diff
Patch does not have a valid e-mail address.
-
James Le Cuirot
I'm still very new to git and while I understand the concept, it still confuses the hell out of me. However, from what I can see "am" is for merging patches from a mailbox. You should use "apply" instead.
-
-
James Le Cuirot
I was going to add some but I think forgery protection is disabled during tests anyway?
-
Pratik
Chewi, have a look at request_forgery_protection_test.rb file. That should give you a rough idea.
Thanks.
-
James Le Cuirot
Ah I was looking at prototype_helper_test.rb. The thing is there is currently no test to check whether remote_function DOES add the token for non-GET requests either. I guess I should write one for that too?
-
CancelProfileIsBroken
- Tag set to actionpack, edge, patch, request-forgery-protection
- State changed from incomplete to resolved
Obsolete due to updates in the past year ;)
-
justin
- Importance changed from to
Why was this closed out as resolved with the note that it is obsolete?
I see this bug in 2.3.5 and the head of the Rails source (RC for Rails 3) shows the same code.
See line #620 include field ignored of ActionView::Helpers#options_for_ajax here:
http://github.com/rails/rails/blob/master/actionpack/lib/action_vie...