diff --git a/app/controllers/tutorials_controller.rb b/app/controllers/tutorials_controller.rb index 3a9b400..08cee31 100755 --- a/app/controllers/tutorials_controller.rb +++ b/app/controllers/tutorials_controller.rb @@ -36,6 +36,24 @@ class TutorialsController < ApplicationController def csrf @meta_code_bad = %{<%#= csrf_meta_tags %> } @meta_code_good = %{<%= csrf_meta_tags %> } + @ajax_code_good = %q{ + ("#example_submit_button_id").click(function(event) { + var valuesToSubmit = $("#example_form_id").serialize(); + event.preventDefault(); + $.ajax(\{ + url: "/example", + data: valuesToSubmit, + type: "POST", + success: function(response) \{ + alert('success!'); + }, + error: function(event) \{ + alert('failure!'); + \} + \}); + \}); + + \} } end def misconfig diff --git a/app/views/layouts/tutorial/csrf/_csrf_first.html.erb b/app/views/layouts/tutorial/csrf/_csrf_first.html.erb index b08e0fc..79c7213 100755 --- a/app/views/layouts/tutorial/csrf/_csrf_first.html.erb +++ b/app/views/layouts/tutorial/csrf/_csrf_first.html.erb @@ -74,13 +74,28 @@
Cross-Site Request Forgery SOLUTION:
- By Default, the protect_from_forgery directive is added under the application_controller.rb at project creation. However, occasionally developers turn it off (comment out) because of issues with JS. The solution around the JS problem is to add the following code within the header section of the application.html.erb file (or any other application layout file). + By Default, the protect_from_forgery directive is added under the application_controller.rb at project creation. However, occasionally developers turn it off (comment out) because of issues with JS. There are two separate solutions around the JS problem. +
++ Once protect_from_forgery is added back... +
<%= @meta_code_good %>+
+ That will allow you to parse the meta tag with JS. However, keep in mind that any form generated by Rails is populated with an authenticity token so, if you leverage something like JQuery to make an Ajax request, you can include all values within the form by using the technique shown next. +
++
+
+ <%= @ajax_code_good %> ++ @@ -94,7 +109,7 @@