17 lines
746 B
Text
17 lines
746 B
Text
|
FormCanary will examine your outgoing HTML and add a canary value to
|
||
|
|
each form. When the form is submitted, the value of the canary is com-
|
||
|
|
pared against one saved in the session at page generation time. If the
|
||
|
|
canary that's sent doesn't match the one in the session (or there is no
|
||
|
|
canary at all), the request is halted.
|
||
|
|
|
||
|
|
There is no way to get params into your application without a correct
|
||
|
|
canary. This is good for preventing "cross-site request attacks".
|
||
|
|
|
||
|
|
This module is compatible with FormBuilder. Just drop it into your use
|
||
|
|
line and have secure submit-once-only forms. Yay.
|
||
|
|
|
||
|
|
Inspired by:
|
||
|
|
http://www.25hoursaday.com/weblog/2007/06/05/WhatRubyOnRailsCanLearnFromASPNET.aspx
|
||
|
|
|
||
|
|
WWW: http://search.cpan.org/dist/Catalyst-Plugin-FormCanary/
|