Rails session decoding and CSRF testing

rails_session_decoding.rb

def decrypt_session(session_cookie)
  secret_key_base = Rails.application.secrets.secret_key_base

  cookie = CGI::unescape(session_cookie)
  salt          = 'encrypted cookie'
  signed_salt   = 'signed encrypted cookie'
  key_generator = ActiveSupport::KeyGenerator.new(secret_key_base, iterations: 1000)
  secret = key_generator.generate_key(salt)
  sign_secret = key_generator.generate_key(signed_salt)
  encryptor = ActiveSupport::MessageEncryptor.new(secret, sign_secret)

  encryptor.decrypt_and_verify(cookie)
end


#from page source, in meta tag:
token = "..."

session = decrypt_session(session_cookie).symbolize_keys

ApplicationController.new.send(:valid_authenticity_token?,session, token)

#or
#csrf_token = ApplicationController.new.send(:unmask_token, Base64.strict_decode64(token))
#real_csrf_token = Base64.strict_decode64(session[:_csrf_token])
#ActiveSupport::SecurityUtils.secure_compare(csrf_token, real_csrf_token)