Enable CSRF Protection protect #1209
Conversation
rhythmdesai404
commented
Oct 22, 2024
rhythmdesai404
commented
- Enabled CSRF Protection
rhythmdesai404
requested review from
a team,
ahayworth,
arielvalentin,
dazuma,
ericmustin,
fbogsany,
kaylareopelle,
mwear,
plantfansam,
robbkidd,
robertlaurin,
simi and
xuan-cao-swi
as code owners
|
/easycla |
1 similar comment
|
/easycla |
ericmustin
changed the base branch from
main
to
add_defensiveness_on_callables
ericmustin
changed the base branch from
add_defensiveness_on_callables
to
main
|
Misclick, sorry about that. Is this PR ready for review? |
| # Enable CSRF Protection | ||
| protect_from_forgery with: :exception |
There was a problem hiding this comment.
Hi @rhythmdesai404! Since I haven't heard back from you after Eric's comment earlier, I'm assuming this is ready for review.
I'm curious about why we need to turn this on. This is test code, and shouldn't impact the user. Why do we need to enable it here?
There was a problem hiding this comment.
Hi @kaylareopelle! Great question. Even though it's test code, enabling CSRF protection is important because it helps ensure that the tests accurately reflect the security measures in place for the actual application. By turning it on, we:
Simulate Real Conditions: Make sure the test environment mimics the real application environment, including its security features.
Consistency: Maintain consistency in how the application handles requests, whether in testing or in production.
In short, enabling CSRF protection in test code helps ensure that your application is secure and behaves as expected in all scenarios.
There was a problem hiding this comment.
Thank you for the context, @rhythmdesai404! That makes sense to me. If you'd still like to see this change, please reopen the PR and we'll give it a look.
|
👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the |
rhythmdesai404
left a comment
rhythmdesai404
left a comment
There was a problem hiding this comment.
Enable CSRF protection to ensure test environment security
This change simulates real application conditions, catches potential issues early,
and maintains consistency in request handling across all environments.
protect_from_forgery with: :exception
| # Enable CSRF Protection | ||
| protect_from_forgery with: :exception |
There was a problem hiding this comment.
Hi @kaylareopelle! Great question. Even though it's test code, enabling CSRF protection is important because it helps ensure that the tests accurately reflect the security measures in place for the actual application. By turning it on, we:
Simulate Real Conditions: Make sure the test environment mimics the real application environment, including its security features.
Consistency: Maintain consistency in how the application handles requests, whether in testing or in production.
In short, enabling CSRF protection in test code helps ensure that your application is secure and behaves as expected in all scenarios.
3 participants
