重构为 RubyAmf Rails 后似乎并没有抱怨authenticity_token
我正在构建 Flex 4 + Rails 2.3.5 应用程序。首先，我使用 XML 来传递日期，并且曾经收到一个错误，抱怨真实性令牌，然后我手动传递该令牌来解决该错误。
之后，我重构了我的代码以使用 RubyAmf，这似乎可以工作，但我一开始没有传递authenticity_token，但我注意到 Rails 没有抱怨并且请求通过了。我的应用程序仍然未注释 protected_from_forgery。
RubyAmf 是否会以某种方式绕过它？
谢谢，
谭
I'm building a Flex 4 + Rails 2.3.5 application. First I was using XML to pass date through and I used to get an error complaining about Authenticity Token which I passed manually then to get through the error.
After that I re-factored my code to use RubyAmf which seems to be working but I didn't pass in the authenticity_token at first but I noticed that Rails didn't complain and the request went through. My app still have protect_from_forgery uncommented.
Does RubyAmf bypass that somehow?
Thanks,
Tam
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
Ruby AMF 直接调用控制器操作，并在序列化到 AMF 后返回结果。这与首先通过路由器的标准 HTTP 请求的工作方式相反。
Ruby AMF directly calls controller actions and returns the results after serializing to AMF. This is opposed to how a standard HTTP request works which goes through the router first.
我相信伪造保护不会针对 GET 请求触发，只会针对 POSTS、DELETE 和 PUT 触发。也许您正在测试的场景正在执行 GET 请求？
I believe forgery protection does not fire off for GET requests, only POSTS, DELETE and PUTs. Maybe the scenario you're testing is executing a GET request?
更详细地解释 camwest 的答案：
当您向
articles_controller、update操作发出 AMF 请求时，该请求实际上不会发送到该控制器并直接采取行动。此 AMF 请求（这是一个 POST 请求）实际上通过 Rails 路由器到达rubyamf_controller、gateway操作（AMF 端点）。目标控制器和操作（articles_controller、update操作）被标记为此 POST 请求的参数。此 POST 调用上设置的
mime_type为amf。 RubyAMF 插件将此mime_type添加到不检查伪造保护的 mime_type 列表中。因此，即使没有authenticity_token，对rubyamf_controller、gateway操作的调用也会成功完成。从 Flex 中，您可能已向
articles_controller、update操作发送了一些参数。它们作为序列化的 AMF 对象到达gateway操作。这些参数在这里被反序列化。然后，
gateway操作在内部调用目标控制器和操作（articles_controller、update操作）。目标操作执行其任务并返回响应。gateway操作获取此目标操作的响应，将其序列化为 AMF 并将其发送回客户端。在 Rails 2.x 中，此内部调用不会调用伪造保护机制。因此，即使您不将
authenticity_token作为参数之一发送到目标操作，它也可以正常工作。这在 Rails 3 中发生了变化。甚至内部调用也会调用伪造保护机制。目标操作检查是否存在
authenticity_token参数。因此，您需要从 Flex 发送它。更多信息请参见：http://anjantek.com/2011 /05/08/rails-3-rubyamf-flex-csrf-解决方案/
To explain camwest's answer in a little more detail:
When you make an AMF request to, say, the
articles_controller,updateaction, the request doesn't actually go to that controller and action directly. This AMF request (which is a POST request) actually reaches therubyamf_controller,gatewayaction (AMF end point) through the Rails router. The destination controller and action (articles_controller,updateaction) are tagged on as parameters to this POST request.The
mime_typeset on this POST call isamf. The RubyAMF plugin adds thismime_typeto the list of mime_types that are not checked for forgery protection. Hence, the call to therubyamf_controller,gatewayaction goes through successfully, even without theauthenticity_token.From Flex, you may have sent some parameters to the
articles_controller,updateaction. These arrive as a serialized AMF object to thegatewayaction. These parameters are deserialized here.The
gatewayaction then internally calls the target controller and action (articles_controller,updateaction). The target action does its stuff and returns a response. Thegatewayaction obtains the response of this target action, serializes it into AMF and sends it back to the client.In Rails 2.x, this internal call did not invoke the forgery protection mechanism. So, even if you do not send the
authenticity_tokenas one of the parameters to the target action, it works fine.This changed in Rails 3. Even the internal call invokes the forgery protection mechanism. The target action checks for the presence of the
authenticity_tokenparameter. So, you need to send it from Flex.More here: http://anjantek.com/2011/05/08/rails-3-rubyamf-flex-csrf-solution/