Protection against Cross Site Request Forgery (CSRF) is an important Rails security feature. Triggered by calling the protect_from_forgery method within ApplicationController, this module helps avoid attacks from tricksy web page that generate forged requests to your application. I won’t describe the details here, but the typical vector is an unwitting user who is authenticated to your app, but is currently viewing a malicious page.
For some time, Rails has protected against this sort of attack using a hidden input field named authenticity_token in every form. A form post with an invalid or missing authenticity_token was rejected by raising an ActionController::InvalidAuthenticityToken exception. As part of a security patch released with Rails 3.0.4, the default behavior is now reset_session. The unfortunate side effect of this security patch is to expose applications using the Clearance or Authlogic gems to CSRF attacks.
The logic in the Rails change is valid: If the credentials are destroyed, a tokenless request can do no harm since its authorization is restricted to that of an un-authenticated user. However, the gems I mention store login credentials in dedicated cookies that live outside the Rails session mechanism, and are unaffected by reset_session. Suddenly the tokenless request proceeds with the user authentication intact, with potentially harmful results. I’m not casting blame for any coding choices here; it’s simply a coordination problem.
The Rails change creates the new controller method:
def handle_unverified_request reset_session end
If your authentication credentials don’t live in the Rails session, the simplest fix is to override this method in ApplicationController. There are several options:
Raise the exception used as Rails < 3.0.4. Note this exception may be removed at some future time.
def handle_unverified_request raise ActionController::InvalidAuthenticityToken end
Or block the effects of your authentication cookie.
def handle_unverified_request super self.current_user = nil cookies.delete(:your_custom_cookie) end
Fortunately the Clearance gem has already been updated to use the latter option. Projects using Rails >= 3.0.4 should update to Clearance 0.10.5 or later immediately.
The Authlogic gem was last updated in August 2010, so I recommend overriding handle_unverified_request similar to one of the examples above.
Update: Jason Weathered has a good writeup on this issue as well.



I know it’s not just me. I know there are plenty of folks out there who are easily distracted. One moment you’re focused on a task, then all of the sudden, “SQUIRREL!” If you’ve seen the 


