# Please forward to RoR crowd ( my news-server doesn't carry, and I'm not getting Goog Account :)

**URL:** <https://www.ruby-forum.com/t/please-forward-to-ror-crowd-my-news-server-doesnt-carry-and-im-not-getting-goog-account/124940>\
**Category:** Ruby\
**Created:** [January 3, 2008, 9:56pm UTC](https://www.ruby-forum.com/t/please-forward-to-ror-crowd-my-news-server-doesnt-carry-and-im-not-getting-goog-account/124940 "2008-01-03T21:56:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Antryg\_Bogus\_Addres](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/45deac/32.png) [@Antryg\_Bogus\_Addres](https://www.ruby-forum.com/u/Antryg_Bogus_Addres)\
**Post date:** [January 3, 2008, 9:56pm UTC](https://www.ruby-forum.com/t/please-forward-to-ror-crowd-my-news-server-doesnt-carry-and-im-not-getting-goog-account/124940/1 "2008-01-03T21:56:43Z")

</div>

[http://www2.csoonline.com/exclusives/column.html?CID=33395](http://www2.csoonline.com/exclusives/column.html?CID=33395)

Article on Cross Site Request forgery, saying that only a solution  
internal-to-the-server can break the technique, and only if  
it’s so pervasive that the attack itself becomes worthless.

Sorry I’m asking you to forward, but this matters!

Thanks,

-Antryg

---

<div class="post-metadata">

**Author:** ![Antryg\_Bogus\_Addres](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/45deac/32.png) [@Antryg\_Bogus\_Addres](https://www.ruby-forum.com/u/Antryg_Bogus_Addres)\
**Post date:** [January 5, 2008, 2:52am UTC](https://www.ruby-forum.com/t/please-forward-to-ror-crowd-my-news-server-doesnt-carry-and-im-not-getting-goog-account/124940/2 "2008-01-05T02:52:29Z")

</div>

Antryg Bogus Address wrote:

> [http://www2.csoonline.com/exclusives/column.html?CID=33395](http://www2.csoonline.com/exclusives/column.html?CID=33395)
> 
> Article on Cross Site Request forgery, saying that only a solution internal-to-the-server can break the technique, and only if  
> it’s so pervasive that the attack itself becomes worthless.
> 
> Sorry I’m asking you to forward, but this matters!

I use [news.gmane.org](http://news.gmane.org) for viewing/posting to comp.lang.ruby.rails. No  
need for a google account.

cheers,  
mick

---

<div class="post-metadata">

**Author:** ![Antryg\_Bogus\_Addres](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/45deac/32.png) [@Antryg\_Bogus\_Addres](https://www.ruby-forum.com/u/Antryg_Bogus_Addres)\
**Post date:** [January 5, 2008, 3:05am UTC](https://www.ruby-forum.com/t/please-forward-to-ror-crowd-my-news-server-doesnt-carry-and-im-not-getting-goog-account/124940/3 "2008-01-05T03:05:20Z")

</div>

> Article on Cross Site Request forgery, saying that only a solution internal-to-the-server can break the technique, and only if  
> it’s so pervasive that the attack itself becomes worthless.

I haven’t been keeping up on RoR, but different frameworks such as  
Seaside (Smalltalk) and Lift/Liftweb (Scala) avoid the issue by using  
mapped tokens. RoR might have extensions/plugins that offer the same  
functionality. I am unfamiliar how TG, Wicket or other [Ruby] web  
frameworks avoid/handle the problem. In a sense, this is just an  
extension of the “destructive GET requests” that RoR worked to remove  
~1.2 (IIRC).

That being said, wrong ML 🙂