Ruby: protect_from_forgery when is it raised?

Question

I have the following piece of code:

class Foo < ActiveRecord::Base
  protect_from_forgery
end

My doubt is when the protect_from_forgery will be called? when an instance of Foo is created?

Thanks in advance

Answer 1

Someone with more knowledge than myself might know a better answer but here is how I understand it:

When the browser sends a post request, rails includes an additional authenticity token with the requests that corresponds to that users session. If I knew another users authenticity token, I could add an html element on the page that includes their token and submit requests posing as their user. This is called Cross Site Request Forgery. To protect your site from such attacks, rails includes a method called protect_from_forgery. This method should be placed at the top of your Application Controller so check each request for authenticity.

Further reading can be found on the Rails Guide to Security.