rails 3 authenticity_token how it is generated

Question

does any one know how the authenticity_token of rails3 is generated? I noticed that the value of the token of a form does not change when I refresh the form page. who is it generated? based on session cookie? on time? secret_key?

This answer should have everything you need to know http://stackoverflow.com/questions/941594/understand-rails-authenticity-token — Fareesh Vijayarangam, Aug 06 '11 at 16:24
that does not give details on how the token is generated. which elements are used to ensure the unicity and the security of this token. — enenkey, Aug 06 '11 at 16:31
@enenkey :- do you got the answer to your question ??? if yes then please share it — Aayush Khandelwal, Nov 07 '12 at 07:42

score 6 · Answer 1 · edited May 23 '17 at 12:14

6

The AuthenticityToken is basically a call to ActiveSupport::SecureRandom.base64(32), which you can read about here http://api.rubyonrails.org/classes/ActiveSupport/SecureRandom.html

Edit - Updated to include more recent changes, as per Lambart's answer below.

In Rails >= 3.1, ActiveSupport::SecureRandom is deprecated in favor of SecureRandom from the Ruby standard library (starting with Ruby 1.9.3, it seems).

However it is generated, this token is stored in the session (i.e. it lasts for the lifetime of the session).

Thanks Lambart.

edited May 23 '17 at 12:14

Community

1
1

answered Aug 06 '11 at 17:08

Fareesh Vijayarangam

5,037
4
23
18

1

Can you explain why the token is not changing after page refresh (F5) ? Is it because I'm in dev environment? – enenkey Aug 06 '11 at 17:41
It is stored in the session, so it is not meant to change for the lifetime of the session, no matter what environment you're in. – Lambart Oct 24 '13 at 01:38
Moderators didn't like my edit to update and fix the broken link in Fareesh's otherwise-informative (but dated) answer, so I guess I'd better just write my own. – Lambart Oct 24 '13 at 17:55

score 0 · Answer 2 · answered Oct 24 '13 at 17:55

In Rails < 3.09, the AuthenticityToken is generated by a call to ActiveSupport::SecureRandom.base64(32), which you can read about here.

In Rails >= 3.1, ActiveSupport::SecureRandom is deprecated in favor of SecureRandom from the Ruby standard library (starting with Ruby 1.9.3, it seems).

However it is generated, this token is stored in the session (i.e. it lasts for the lifetime of the session).

rails 3 authenticity_token how it is generated

2 Answers2

Linked