As the title states, I wonder how I can change the meta tags name of csrf-param
and csrf-token
?
<meta content="authenticity_token" name="csrf-param" />
<meta content="123456" name="csrf-token" />
I'm asking this, because for safety reason I want to hide, which technology I'm using to power my website. The Chrome plugin Wappalyzer
uses this meta tags as indicators for Ruby on Rails
.
CSRF tokens normally go in a form as hidden form fields. Putting them in a meta tag only makes sense if you are using JavaScript. JavaScript could read the tokens from the meta tag and post them to an action.
Rails CSRF TokenThe server generates these tokens, links them to the user session, and stores them in the database. This token is then injected into any form presented to the client as a hidden field. When the client correctly submits the form for validation, it passes the token back to the server.
When the user submits the form, Rails looks for the authenticity_token , compares it to the one stored in the session, and if they match the request is allowed to continue. Since the authenticity token is stored in the session, the client cannot know its value.
Briefly, Cross-Site Request Forgery (CSRF) is an attack that allows a malicious user to spoof legitimate requests to your server, masquerading as an authenticated user. Rails protects against this kind of attack by generating unique tokens and validating their authenticity with each submission.
Create an initializer called change_csrf_name.rb
inside this file you can change the :name => 'xyz'
. beware that it might break some built in functionality you were not expecting.
module ActionView
module Helpers
module CsrfHelper
def csrf_meta_tags
if protect_against_forgery?
[
tag('meta', :name => 'csrf-param', :content => request_forgery_protection_token),
tag('meta', :name => 'csrf-token', :content => form_authenticity_token)
].join("\n").html_safe
end
end
end
end
end
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With