A sample controller and route demonstrating CSRF vulnerabilities

csrf.rb

class AcountsController < ApplicationController
  before_action :set_current_user

  def transfer
    from_account = Account.find(owner_id: current_user.id)
    to_account = Account.find(id: params(:to_id)
    AccountTransferService.call(from: from_account, to: to_account, amount: params(:amount))
  end
end

Rails.application.routes.draw do
  match "accounts/transfer", to: "accounts#transfer", via [:get, :post]
end