# Ajax CSRF in Rails3

**URL:** <https://www.ruby-forum.com/t/ajax-csrf-in-rails3/195306>\
**Category:** Rails\
**Created:** [September 21, 2010, 1:46pm UTC](https://www.ruby-forum.com/t/ajax-csrf-in-rails3/195306 "2010-09-21T13:46:37Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ft51](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/cdc98d/32.png) [@Ft51](https://www.ruby-forum.com/u/Ft51)\
**Post date:** [September 21, 2010, 1:46pm UTC](https://www.ruby-forum.com/t/ajax-csrf-in-rails3/195306/1 "2010-09-21T13:46:37Z")

</div>

I’m using rails3. It does not seem to check the authenticity\_token  
when doing a POST using Ajax. I traced this to:

module ActionDispatch  
class Request \< Rack::Request  
…  
def forgery\_whitelisted?  
get? || xhr? || content\_mime\_type.nil? || !  
content\_mime\_type.verify\_request?  
end  
end

so you don’t check if its a get? or a xhr? (ie ajax request). Is this  
correct?

---

<div class="post-metadata">

**Author:** ![Ft51](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/cdc98d/32.png) [@Ft51](https://www.ruby-forum.com/u/Ft51)\
**Post date:** [September 21, 2010, 2:17pm UTC](https://www.ruby-forum.com/t/ajax-csrf-in-rails3/195306/2 "2010-09-21T14:17:39Z")

</div>

On Sep 21, 7:43 am, Ft51 [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> end
> 
> so you don’t check if its a get? or a xhr? (ie ajax request). Is this  
> correct?

Seems correct to me:  
GET requests shouldn’t be doing anything where it matters if the  
request is coming from another domain.  
XHR requests don’t support cross-domain calls. So you don’t have to  
worry about it coming from another domain.

---

<div class="post-metadata">

**Author:** ![Ft51](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/cdc98d/32.png) [@Ft51](https://www.ruby-forum.com/u/Ft51)\
**Post date:** [September 21, 2010, 3:45pm UTC](https://www.ruby-forum.com/t/ajax-csrf-in-rails3/195306/3 "2010-09-21T15:45:28Z")

</div>

Thanks, that makes sense!

---

<div class="post-metadata">

**Author:** ![Ft51](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/cdc98d/32.png) [@Ft51](https://www.ruby-forum.com/u/Ft51)\
**Post date:** [September 21, 2010, 6:25pm UTC](https://www.ruby-forum.com/t/ajax-csrf-in-rails3/195306/4 "2010-09-21T18:25:17Z")

</div>

doesnt $.getScript passes from data from one domain to another?

---

<div class="post-metadata">

**Author:** ![Ft51](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/cdc98d/32.png) [@Ft51](https://www.ruby-forum.com/u/Ft51)\
**Post date:** [September 21, 2010, 8:21pm UTC](https://www.ruby-forum.com/t/ajax-csrf-in-rails3/195306/5 "2010-09-21T20:21:47Z")

</div>

On Sep 21, 12:23 pm, radhames brito [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> doesnt $.getScript passes from data from one domain to another?

I doubt it. It probably uses XMLHttpRequest

---

<div class="post-metadata">

**Author:** ![Ft51](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/cdc98d/32.png) [@Ft51](https://www.ruby-forum.com/u/Ft51)\
**Post date:** [September 21, 2010, 9:52pm UTC](https://www.ruby-forum.com/t/ajax-csrf-in-rails3/195306/6 "2010-09-21T21:52:32Z")

</div>

On Sep 21, 2:30 pm, radhames brito [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> just comfirmed an getscript does cross-domain calls
> 
> some guys are using it to send https data over http
> 
> [Secure Ajax from Non-Secure Pages | Viget](http://www.viget.com/extend/secure-ajax-from-non-secure-pages/)

Actually, that page specifically says that it doesn’t work cross  
domain, or even cross protocol:

“the JavaScript same origin policy prevents you from making an Ajax  
request from your non-secure page to a secure page”

And the example doesn’t show any use of cross domain or cross protocol  
calls.

---

<div class="post-metadata">

**Author:** ![Ft51](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/cdc98d/32.png) [@Ft51](https://www.ruby-forum.com/u/Ft51)\
**Post date:** [September 21, 2010, 8:31pm UTC](https://www.ruby-forum.com/t/ajax-csrf-in-rails3/195306/7 "2010-09-21T20:31:44Z")

</div>

just comfirmed an getscript does cross-domain calls

some guys are using it to send https data over http

> **[Secure Ajax from Non-Secure Pages | Viget](https://www.viget.com/articles/secure-ajax-from-non-secure-pages/)**
>
> Ok, here’s a problem: you have a login form on your web app that needs to be protected via SSL. In addition, on every other page – none of which use SSL – you have a miniature login form that submits via Ajax. Of course, the JavaScript same origin...

---

<div class="post-metadata">

**Author:** ![Ft51](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/cdc98d/32.png) [@Ft51](https://www.ruby-forum.com/u/Ft51)\
**Post date:** [September 21, 2010, 10:28pm UTC](https://www.ruby-forum.com/t/ajax-csrf-in-rails3/195306/8 "2010-09-21T22:28:15Z")

</div>

class CryptoKeysController \< ApplicationController  
ssl\_required :show

$.getScript(’/profiles/crypto\_key?callback=setCryptData’,

he is calling

the show action with htts from a non https page