Ruby on Rails Cross-Site Request Forgery  – Full Disclosure

Posted by Daniel Owens via Fulldisclosure on Apr 26

Good morning. All current versions and all versions since the 2022/2023 “fix” to the Rails cross-site request forgery
(CSRF) protections continue to be vulnerable to the same attacks as the 2022 implementation. Currently, Rails
generates “authenticity tokens” and “csrf tokens” using a random “one time pad” (OTP). This random value is then XORed
with the “raw token” (which can take one of two…
 – Read More  – Full Disclosure