In order to mitigate SSL attacks, form_authenticity_token is now masked so that it varies with each request. Thus, tokens are validated by unmasking and then decrypting. As a result, any strategies for verifying requests from non-rails forms that relied on a static session CSRF token have to take this into account.

valid_rails42_authenticity_token.coffee

bufferEqual = require('buffer-equal')

authenticityTokenLength = 32

unmaskCSRFToken= (maskedToken) ->
	if maskedToken.length == authenticityTokenLength
		return maskedToken
	else if maskedToken.length == authenticityTokenLength * 2
		oneTimePad = maskedToken.slice(0, authenticityTokenLength)
		encryptedToken = maskedToken.slice(authenticityTokenLength)
		csrfToken = new Buffer(authenticityTokenLength)
		for i in [0..oneTimePad.length]
			csrfToken[i] = oneTimePad[i] ^ encryptedToken[i]
		return csrfToken
	else
		console.error "The CSRF token is malformed."
		return null

compareCSRFToken= (realCSRFToken, maskedCSRFToken) ->
	csrfToken = new Buffer(realCSRFToken, 'base64')
	sessionCSRFToken = unmaskCSRFToken(new Buffer(maskedCSRFToken, 'base64'))
	return bufferEqual(csrfToken, sessionCSRFToken)