# Is Rails 2.1 "protect\_from\_forgery" == csrf\_killer plugin?

**URL:** <https://www.ruby-forum.com/t/is-rails-2-1-protect-from-forgery-csrf-killer-plugin/147862>\
**Category:** Rails\
**Created:** [September 6, 2008, 8:08am UTC](https://www.ruby-forum.com/t/is-rails-2-1-protect-from-forgery-csrf-killer-plugin/147862 "2008-09-06T08:08:27Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![weyus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7ab992/32.png) [@weyus](https://www.ruby-forum.com/u/weyus)\
**Post date:** [September 6, 2008, 8:08am UTC](https://www.ruby-forum.com/t/is-rails-2-1-protect-from-forgery-csrf-killer-plugin/147862/1 "2008-09-06T08:08:27Z")

</div>

Just would like to verify:

Is protect\_from\_forgery (in Rails 2.1) == the csrf\_killer plugin from  
Rick O.?

Thanks,  
Wes

---

<div class="post-metadata">

**Author:** ![weyus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7ab992/32.png) [@weyus](https://www.ruby-forum.com/u/weyus)\
**Post date:** [September 6, 2008, 9:21am UTC](https://www.ruby-forum.com/t/is-rails-2-1-protect-from-forgery-csrf-killer-plugin/147862/2 "2008-09-06T09:21:20Z")

</div>

On 6 Sep 2008, at 07:08, Wes G. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> Just would like to verify:
> 
> Is protect\_from\_forgery (in Rails 2.1) == the csrf\_killer plugin from  
> Rick O.?

Yup, it was merged in in rails 2.0

Fred

---

<div class="post-metadata">

**Author:** ![weyus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7ab992/32.png) [@weyus](https://www.ruby-forum.com/u/weyus)\
**Post date:** [September 6, 2008, 9:04pm UTC](https://www.ruby-forum.com/t/is-rails-2-1-protect-from-forgery-csrf-killer-plugin/147862/3 "2008-09-06T21:04:49Z")

</div>

Thanks, Frederick.

Follow - up: Is there anything that precludes using protect\_from\_forgery  
with a DB session store?

Wes

---

<div class="post-metadata">

**Author:** ![weyus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7ab992/32.png) [@weyus](https://www.ruby-forum.com/u/weyus)\
**Post date:** [September 6, 2008, 9:47pm UTC](https://www.ruby-forum.com/t/is-rails-2-1-protect-from-forgery-csrf-killer-plugin/147862/4 "2008-09-06T21:47:12Z")

</div>

On 6 Sep 2008, at 20:04, Wes G. wrote:

> Thanks, Frederick.
> 
> Follow - up: Is there anything that precludes using  
> protect\_from\_forgery  
> with a DB session store?

nope (you do however need to pass a secret to protect\_from\_forgery)

Fred

---

<div class="post-metadata">

**Author:** ![weyus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7ab992/32.png) [@weyus](https://www.ruby-forum.com/u/weyus)\
**Post date:** [September 6, 2008, 10:17pm UTC](https://www.ruby-forum.com/t/is-rails-2-1-protect-from-forgery-csrf-killer-plugin/147862/5 "2008-09-06T22:17:19Z")

</div>

Yeah, I just verified that.

Sorry, I should have tested it first.