gearheads
/
mastodon
Archived
2
0
Fork 0
Code Releases 4 Activity

Suppress CSRF token warnings (#6240) 

CSRF token checking was enabled for API controllers in #6223,
producing "Can't verify CSRF token authenticity" log spam. This
disables logging of failed CSRF checks.

This also changes the protection strategy for
PushSubscriptionsController to use exceptions, making it consistent
with other controllers that use sessions.
gh/stable
Patrick Figel 2018-01-15 06:51:23 +01:00 committed by Eugen Rochko
parent 2091ae92be
commit 537d2939b1
2 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
app/controllers/api/web/push_subscriptions_controller.rb
View File

@ -4,6 +4,7 @@ class Api::Web::PushSubscriptionsController < Api::BaseController
respond_to :json respond_to :json
before_action :require_user! before_action :require_user!
protect_from_forgery with: :exception
def create def create
params.require(:subscription).require(:endpoint) params.require(:subscription).require(:endpoint)

3
config/initializers/suppress_csrf_warnings.rb 100644
View File

@ -0,0 +1,3 @@
# frozen_string_literal: true
ActionController::Base.log_warning_on_csrf_failure = false