# CSRF protection and verify :method

**URL:** <https://www.ruby-forum.com/t/csrf-protection-and-verify-method/161198>\
**Category:** Rails\
**Created:** [February 24, 2009, 9:09am UTC](https://www.ruby-forum.com/t/csrf-protection-and-verify-method/161198 "2009-02-24T09:09:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jspencer78](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f14d63/32.png) [@jspencer78](https://www.ruby-forum.com/u/jspencer78)\
**Post date:** [February 24, 2009, 9:09am UTC](https://www.ruby-forum.com/t/csrf-protection-and-verify-method/161198/1 "2009-02-24T09:09:33Z")

</div>

Hi rortalk,

I’ve been looking at my under development site’s exposure to csrf  
attacks. While it is a good thing that rails provides request forgery  
protection for not-gets, it seems to me that for it to actually be  
meaningful you need to take the additional step of restricting the  
methods of your actions.

for example, say i have a destroy method in a controller of a restful  
app. by convention i invoke this using DELETE, and if i do so, request  
forgery protection applies. however, by default it is also possible to  
invoke it using GET, unless i explicitly do something like  
verify :method =\> :delete, :only =\> [:destroy]

this is potentially very bad … as an example, attackers could use  
something cheesy like a lot of

![](http://mysite.com/valuabledocuments/destroy/1)

for 1…99999

on any page to have visiting users destroy all their valuable  
documents. obviously similar problems apply in terms of the ability to  
invoke update and create using GET without an explicit verify :method.

it seems to me like it would be sensible to provide an option  
(possibly a default) to verify that restful resources are accessed  
using only the correct http verbs.

one alternative is to have in the ApplicationController:

verify :method =\> :post, :only =\> [:post]  
verify :method =\> :put, :only =\> [:update]  
verify :method =\> :delete, :only =\> [:destroy]

which seems to work ok … although it breaks the tests for  
restful\_authentication, apparently (yet to look into it)

thoughts?

---

<div class="post-metadata">

**Author:** ![jspencer78](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f14d63/32.png) [@jspencer78](https://www.ruby-forum.com/u/jspencer78)\
**Post date:** [February 24, 2009, 9:10am UTC](https://www.ruby-forum.com/t/csrf-protection-and-verify-method/161198/2 "2009-02-24T09:10:47Z")

</div>

On Feb 24, 5:47 am, James S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> it seems to me like it would be sensible to provide an option  
> (possibly a default) to verify that restful resources are accessed  
> using only the correct http verbs.
> 
> one alternative is to have in the ApplicationController:
> 
> verify :method =\> :post, :only =\> [:post]  
> verify :method =\> :put, :only =\> [:update]  
> verify :method =\> :delete, :only =\> [:destroy]

Or if you delete the default route from routes.rb then you don’t need  
this.

Fred

---

<div class="post-metadata">

**Author:** ![jspencer78](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f14d63/32.png) [@jspencer78](https://www.ruby-forum.com/u/jspencer78)\
**Post date:** [February 24, 2009, 10:37pm UTC](https://www.ruby-forum.com/t/csrf-protection-and-verify-method/161198/3 "2009-02-24T22:37:27Z")

</div>

aha. thanks fred

On Feb 24, 7:09 pm, Frederick C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)