07 · Cross-Site Request Forgery (CSRF)

class ApplicationController < ActionController::Base
  # on by default since Rails 5.2; being explicit makes failures loud
  protect_from_forgery with: :exception

  rescue_from ActionController::InvalidAuthenticityToken do
    terminate_session if respond_to?(:terminate_session, true)   # generator helper
    cookies.delete(:remember_token)
    redirect_to new_session_path, alert: "Please sign in again."
  end
end

<%# app/views/layouts/application.html.erb %>
<%= csrf_meta_tags %>                         <%# token for Turbo / JS %>
<%= form_with model: @transfer do |f| %>      <%# hidden authenticity_token %>

// your own fetch() calls
fetch("/transfers", { method: "POST", headers: {
  "X-CSRF-Token": document.querySelector("meta[name=csrf-token]").content }, body })

// npm install csrf-sync   (synchronizer token pattern)
const { csrfSynchronisedProtection, generateToken } = require("csrf-sync")({
  getTokenFromRequest: req => req.body._csrf || req.get("x-csrf-token"),
});
app.use(session(/* … */));
app.use(csrfSynchronisedProtection);   // checks POST/PUT/PATCH/DELETE

app.get("/transfer", (req, res) =>
  res.render("transfer", { csrfToken: generateToken(req) }));

<!-- template -->
<meta name="csrf-token" content="<%= csrfToken %>">
<form method="post" action="/transfer">
  <input type="hidden" name="_csrf" value="<%= csrfToken %>"> …

// fetch from your own JS
fetch("/transfer", { method: "POST", headers: {
  "X-CSRF-Token": document.querySelector("meta[name=csrf-token]").content }, body });

# Django: CsrfViewMiddleware is enabled by default
#   <form method="post">{% csrf_token %} … </form>
#   JS: send the csrftoken cookie value in the X-CSRFToken header

# Flask: pip install flask-wtf
from flask_wtf.csrf import CSRFProtect
csrf = CSRFProtect(app)          # checks POST/PUT/PATCH/DELETE

#   <meta name="csrf-token" content="{{ csrf_token() }}">
#   <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
#   fetch(url, {method:"POST", headers:{"X-CSRFToken": token}})