0

The header comment for Rack::Protection::FormToken says:

# This middleware is not used when using the Rack::Protection collection,
# since it might be a security issue, depending on your application

Can anyone describe an example of when this middleware becomes a security issue?

dgo.a
  • 2,634
  • 23
  • 35

1 Answers1

0

According to https://github.com/rkh/rack-protection/issues/38 "FormToken lets through xhr requests without token."

So if you were relying on form tokens and had not taken extra steps to protect against xhr requests, then this might be considered a security risk. You might assume a request was genuine (since it's protected by FormToken - right!?) when in fact it was a forgery. By forcing you install FormToken explicitly, the developers are hoping that you will examine what it does and take the necessary steps.

Onnadu
  • 11
  • 1