返回列表 发帖

rails2.0中的protect_from_forgery

rails2.0为了防范CSRF (Cross-Site Request Forgery)攻击,提供了一个小小的手段,那就是protect_from_forgery,对于从1.x升级而来的我,确为此头疼了几个小时。

按照1.x的惯例,我写了几个接受post方法的action,并且在其中设置了断点,然后debug,但是无论怎样,程序在断点处都不会停住。而采用get方法直接访问,就会在断点处停止。最开始怀疑的是Module ActionController::Verification::ClassMethods中的verify方法,是不是不允许post访问,结果试了几次,发现症状不同。所以继续思考,这个时候基本上已经是确定filter环节的问题,因为这些action是通过ajax调用,所以看不到错误信息,为了看到错误信息,手动写了个form,然后执行submit,结果出现错误页面如下:
  1. ActionController::InvalidAuthenticityToken in WelcomeController#auto_complete_for_welcome_to

  2. ActionController::InvalidAuthenticityToken

  3. RAILS_ROOT: D:/My Documents/NetBeansProjects/MovieShowtimes
  4. Application Trace | Framework Trace | Full Trace

  5. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/request_forgery_protection.rb:79:in `verify_authenticity_token'
  6. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/filters.rb:469:in `call'
  7. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/filters.rb:441:in `run'
  8. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/filters.rb:716:in `run_before_filters'
  9. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/filters.rb:695:in `call_filters'
  10. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/filters.rb:689:in `perform_action_without_benchmark'
  11. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/benchmarking.rb:68:in `perform_action_without_rescue'
  12. C:/ruby/lib/ruby/1.8/benchmark.rb:293:in `measure'
  13. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/benchmarking.rb:68:in `perform_action_without_rescue'
  14. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/rescue.rb:199:in `perform_action_without_caching'
  15. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/caching.rb:678:in `perform_action'
  16. C:/ruby/lib/ruby/gems/1.8/gems/activerecord-2.0.2/lib/active_record/connection_adapters/abstract/query_cache.rb:33:in `cache'
  17. C:/ruby/lib/ruby/gems/1.8/gems/activerecord-2.0.2/lib/active_record/query_cache.rb:8:in `cache'
  18. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/caching.rb:677:in `perform_action'
  19. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/base.rb:524:in `process_without_filters'
  20. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/filters.rb:685:in `process_without_session_management_support'
  21. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/session_management.rb:123:in `process'
  22. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/base.rb:388:in `process'
  23. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/dispatcher.rb:171:in `handle_request'
  24. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/dispatcher.rb:115:in `dispatch'
  25. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/dispatcher.rb:126:in `dispatch_cgi'
  26. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/dispatcher.rb:9:in `dispatch'
  27. C:/ruby/lib/ruby/gems/1.8/gems/rails-2.0.2/lib/webrick_server.rb:112:in `handle_dispatch'
  28. C:/ruby/lib/ruby/gems/1.8/gems/rails-2.0.2/lib/webrick_server.rb:78:in `service'
  29. C:/ruby/lib/ruby/1.8/webrick/httpserver.rb:104:in `service'
  30. C:/ruby/lib/ruby/1.8/webrick/httpserver.rb:65:in `run'
  31. C:/ruby/lib/ruby/1.8/webrick/server.rb:173:in `start_thread'
  32. C:/ruby/lib/ruby/1.8/webrick/server.rb:162:in `start_thread'
  33. C:/ruby/lib/ruby/1.8/webrick/server.rb:95:in `start'
  34. C:/ruby/lib/ruby/1.8/webrick/server.rb:92:in `start'
  35. C:/ruby/lib/ruby/1.8/webrick/server.rb:23:in `start'
  36. C:/ruby/lib/ruby/1.8/webrick/server.rb:82:in `start'
  37. C:/ruby/lib/ruby/gems/1.8/gems/rails-2.0.2/lib/webrick_server.rb:62:in `dispatch'
  38. C:/ruby/lib/ruby/gems/1.8/gems/rails-2.0.2/lib/commands/servers/webrick.rb:66
  39. C:/ruby/lib/ruby/site_ruby/1.8/rubygems/custom_require.rb:27:in `require'
  40. C:/ruby/lib/ruby/gems/1.8/gems/activesupport-2.0.2/lib/active_support/dependencies.rb:496:in `require'
  41. C:/ruby/lib/ruby/gems/1.8/gems/activesupport-2.0.2/lib/active_support/dependencies.rb:342:in `new_constants_in'
  42. C:/ruby/lib/ruby/gems/1.8/gems/activesupport-2.0.2/lib/active_support/dependencies.rb:496:in `require'
  43. C:/ruby/lib/ruby/gems/1.8/gems/rails-2.0.2/lib/commands/server.rb:39
  44. C:/ruby/lib/ruby/site_ruby/1.8/rubygems/custom_require.rb:27:in `require'
  45. script\server:3

  46. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/request_forgery_protection.rb:79:in `verify_authenticity_token'
  47. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/filters.rb:469:in `call'
  48. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/filters.rb:441:in `run'
  49. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/filters.rb:716:in `run_before_filters'
  50. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/filters.rb:695:in `call_filters'
  51. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/filters.rb:689:in `perform_action_without_benchmark'
  52. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/benchmarking.rb:68:in `perform_action_without_rescue'
  53. C:/ruby/lib/ruby/1.8/benchmark.rb:293:in `measure'
  54. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/benchmarking.rb:68:in `perform_action_without_rescue'
  55. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/rescue.rb:199:in `perform_action_without_caching'
  56. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/caching.rb:678:in `perform_action'
  57. C:/ruby/lib/ruby/gems/1.8/gems/activerecord-2.0.2/lib/active_record/connection_adapters/abstract/query_cache.rb:33:in `cache'
  58. C:/ruby/lib/ruby/gems/1.8/gems/activerecord-2.0.2/lib/active_record/query_cache.rb:8:in `cache'
  59. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/caching.rb:677:in `perform_action'
  60. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/base.rb:524:in `process_without_filters'
  61. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/filters.rb:685:in `process_without_session_management_support'
  62. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/session_management.rb:123:in `process'
  63. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/base.rb:388:in `process'
  64. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/dispatcher.rb:171:in `handle_request'
  65. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/dispatcher.rb:115:in `dispatch'
  66. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/dispatcher.rb:126:in `dispatch_cgi'
  67. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/dispatcher.rb:9:in `dispatch'
  68. C:/ruby/lib/ruby/gems/1.8/gems/rails-2.0.2/lib/webrick_server.rb:112:in `handle_dispatch'
  69. C:/ruby/lib/ruby/gems/1.8/gems/rails-2.0.2/lib/webrick_server.rb:78:in `service'
  70. C:/ruby/lib/ruby/1.8/webrick/httpserver.rb:104:in `service'
  71. C:/ruby/lib/ruby/1.8/webrick/httpserver.rb:65:in `run'
  72. C:/ruby/lib/ruby/1.8/webrick/server.rb:173:in `start_thread'
  73. C:/ruby/lib/ruby/1.8/webrick/server.rb:162:in `start_thread'
  74. C:/ruby/lib/ruby/1.8/webrick/server.rb:95:in `start'
  75. C:/ruby/lib/ruby/1.8/webrick/server.rb:92:in `start'
  76. C:/ruby/lib/ruby/1.8/webrick/server.rb:23:in `start'
  77. C:/ruby/lib/ruby/1.8/webrick/server.rb:82:in `start'
  78. C:/ruby/lib/ruby/gems/1.8/gems/rails-2.0.2/lib/webrick_server.rb:62:in `dispatch'
  79. C:/ruby/lib/ruby/gems/1.8/gems/rails-2.0.2/lib/commands/servers/webrick.rb:66
  80. C:/ruby/lib/ruby/site_ruby/1.8/rubygems/custom_require.rb:27:in `require'
  81. C:/ruby/lib/ruby/gems/1.8/gems/activesupport-2.0.2/lib/active_support/dependencies.rb:496:in `require'
  82. C:/ruby/lib/ruby/gems/1.8/gems/activesupport-2.0.2/lib/active_support/dependencies.rb:342:in `new_constants_in'
  83. C:/ruby/lib/ruby/gems/1.8/gems/activesupport-2.0.2/lib/active_support/dependencies.rb:496:in `require'
  84. C:/ruby/lib/ruby/gems/1.8/gems/rails-2.0.2/lib/commands/server.rb:39
  85. C:/ruby/lib/ruby/site_ruby/1.8/rubygems/custom_require.rb:27:in `require'
  86. C:/ruby/lib/ruby/gems/1.8/gems/ruby-debug-ide-0.1.9/lib/ruby-debug.rb:79:in `main'
  87. C:/ruby/lib/ruby/gems/1.8/gems/ruby-debug-ide-0.1.9/bin/rdebug-ide:74
  88. C:/ruby/bin/rdebug-ide:19

  89. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/request_forgery_protection.rb:79:in `verify_authenticity_token'
  90. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/filters.rb:469:in `call'
  91. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/filters.rb:441:in `run'
  92. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/filters.rb:716:in `run_before_filters'
  93. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/filters.rb:695:in `call_filters'
  94. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/filters.rb:689:in `perform_action_without_benchmark'
  95. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/benchmarking.rb:68:in `perform_action_without_rescue'
  96. C:/ruby/lib/ruby/1.8/benchmark.rb:293:in `measure'
  97. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/benchmarking.rb:68:in `perform_action_without_rescue'
  98. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/rescue.rb:199:in `perform_action_without_caching'
  99. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/caching.rb:678:in `perform_action'
  100. C:/ruby/lib/ruby/gems/1.8/gems/activerecord-2.0.2/lib/active_record/connection_adapters/abstract/query_cache.rb:33:in `cache'
  101. C:/ruby/lib/ruby/gems/1.8/gems/activerecord-2.0.2/lib/active_record/query_cache.rb:8:in `cache'
  102. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/caching.rb:677:in `perform_action'
  103. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/base.rb:524:in `process_without_filters'
  104. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/filters.rb:685:in `process_without_session_management_support'
  105. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/session_management.rb:123:in `process'
  106. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/base.rb:388:in `process'
  107. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/dispatcher.rb:171:in `handle_request'
  108. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/dispatcher.rb:115:in `dispatch'
  109. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/dispatcher.rb:126:in `dispatch_cgi'
  110. C:/ruby/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/dispatcher.rb:9:in `dispatch'
  111. C:/ruby/lib/ruby/gems/1.8/gems/rails-2.0.2/lib/webrick_server.rb:112:in `handle_dispatch'
  112. C:/ruby/lib/ruby/gems/1.8/gems/rails-2.0.2/lib/webrick_server.rb:78:in `service'
  113. C:/ruby/lib/ruby/1.8/webrick/httpserver.rb:104:in `service'
  114. C:/ruby/lib/ruby/1.8/webrick/httpserver.rb:65:in `run'
  115. C:/ruby/lib/ruby/1.8/webrick/server.rb:173:in `start_thread'
  116. C:/ruby/lib/ruby/1.8/webrick/server.rb:162:in `start_thread'
  117. C:/ruby/lib/ruby/1.8/webrick/server.rb:95:in `start'
  118. C:/ruby/lib/ruby/1.8/webrick/server.rb:92:in `start'
  119. C:/ruby/lib/ruby/1.8/webrick/server.rb:23:in `start'
  120. C:/ruby/lib/ruby/1.8/webrick/server.rb:82:in `start'
  121. C:/ruby/lib/ruby/gems/1.8/gems/rails-2.0.2/lib/webrick_server.rb:62:in `dispatch'
  122. C:/ruby/lib/ruby/gems/1.8/gems/rails-2.0.2/lib/commands/servers/webrick.rb:66
  123. C:/ruby/lib/ruby/site_ruby/1.8/rubygems/custom_require.rb:27:in `require'
  124. C:/ruby/lib/ruby/gems/1.8/gems/activesupport-2.0.2/lib/active_support/dependencies.rb:496:in `require'
  125. C:/ruby/lib/ruby/gems/1.8/gems/activesupport-2.0.2/lib/active_support/dependencies.rb:342:in `new_constants_in'
  126. C:/ruby/lib/ruby/gems/1.8/gems/activesupport-2.0.2/lib/active_support/dependencies.rb:496:in `require'
  127. C:/ruby/lib/ruby/gems/1.8/gems/rails-2.0.2/lib/commands/server.rb:39
  128. C:/ruby/lib/ruby/site_ruby/1.8/rubygems/custom_require.rb:27:in `require'
  129. script\server:3
  130. C:/ruby/lib/ruby/gems/1.8/gems/ruby-debug-ide-0.1.9/lib/ruby-debug.rb:79:in `main'
  131. C:/ruby/lib/ruby/gems/1.8/gems/ruby-debug-ide-0.1.9/bin/rdebug-ide:74
  132. C:/ruby/bin/rdebug-ide:19

  133. Request

  134. Parameters:

  135. {"hello"=>""}

  136. Show session dump

  137. ---
  138. :csrf_id: 5572f6d5836d99a6e665ce88f664c741
  139. flash: !map:ActionController::Flash::FlashHash {}


  140. Response

  141. Headers:

  142. {"cookie"=>[],
  143. "Cache-Control"=>"no-cache"}
复制代码
这样一来,事实就清楚了,请查看:
http://api.rubyonrails.org/class ... n/ClassMethods.html

就可以解决一切问题了。

返回列表