Prevent cross-origin js requests

application_controller.rb

class ApplicationController < ActionController::Base
  before_filter :ensure_xhr

  private
    def ensure_xhr
      if request.get? && request.format && (request.format.js? || request.format.json?)
        head :forbidden unless request.xhr?
      end
    end
end

Don't bork your JSON API:

class Api::BaseController < ApplicationController
  skip_before_filter :ensure_xhr
end

Don't bork your JSON API:

class Api::BaseController < ApplicationController
  skip_before_filter :ensure_xhr
end

@javan Confused why you would need to skip the before filter in API. Wouldn't request.xhr? be true?

@javan Confused why you would need to skip the before filter in API. Wouldn't request.xhr? be true?

@tundal45 Not really. I can access an API through any place, not just the browser.

@tundal45 Not really. I can access an API through any place, not just the browser.

@tundal45 request.xhr? is only true for most ajax requests. If your API is for consumption over HTTP, you'll need to skip that check.

@tundal45 request.xhr? is only true for most ajax requests. If your API is for consumption over HTTP, you'll need to skip that check.

Worth noting is that this would go hand-in-hand with all GET .js requests getting the xhr header added. So this would protect on all verbs, including GET.

Worth noting is that this would go hand-in-hand with all GET .js requests getting the xhr header added. So this would protect on all verbs, including GET.

API doesn't usually use cookies so no private info can be CSRF-ed.

API doesn't usually use cookies so no private info can be CSRF-ed.

@javan what about actions working like this

def index
  render 'index.js.erb'
end

They don't have specified params[:format]. I've seen it in the wild

@javan what about actions working like this

def index
  render 'index.js.erb'
end

They don't have specified params[:format]. I've seen it in the wild

@homakov If the incoming request doesn't have .js in the path or a javascript Accept header, request.format.js? will be false. If you've made the decision to still return js in that scenario then the above solution will not protect you.

@homakov If the incoming request doesn't have .js in the path or a javascript Accept header, request.format.js? will be false. If you've made the decision to still return js in that scenario then the above solution will not protect you.