0

I am getting a CSRF Warning in my Rails logs intermittently. I think I have resolved the issue but would like some advice as to whether the solution is sound from a security point of view.

It's a Rails 4 app with Devise application with some Angular JS. Sometimes on a certain page the user session can time out and then we make an AJAX request (though I can see this in normal html requests too it just mainfests itself more regularly in JS) We get a 401 in the logs and can handle from that point. The problem is before that before that 401 we are getting the following message:

WARNING: Can't verify CSRF token authenticity

which is noisy and so I don't know if there is a real attack going on. They're logged out and their token is, I believe, no longer valid.

I believe this is because in Application Controller protect_from_forgery happens before my devise authenticate_user! filter. So:

class ApplicationController < ActionController::Base

  protect_from_forgery
  etc....
end

Happens before

class MyController < ApplicationController

   before_filter :authenticate_user!

   def new
   end
end

If I change the above to prepend_before_action :authenticate_user! the CSRF message goes away. My question is there a (security) reason to not do this? I haven't seen other people do this so assume they must be getting this message too? It makes sense to me that Devise is one of the very first things that happens in our filter chain but don't see that as common practice.

Thanks in advance :)

user3171266
  • 9
  • 1
  • 1
    This discussion may help you if you want to use protection for ajax request: http://stackoverflow.com/questions/14734243/rails-csrf-protection-angular-js-protect-from-forgery-makes-me-to-log-out-on – Sibevin Wang Jan 08 '14 at 04:02
  • I've read that and experimented with it but still the same problem exists in that the XSFR code is before Devise in the filter chain. Some people suggested that putting in a cookie could lead to session fixation? – user3171266 Jan 08 '14 at 22:15

0 Answers0