Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix code scanning alert no. 1: CSRF protection not enabled #23

Merged
merged 1 commit into from
Sep 24, 2024

Conversation

saturnflyer
Copy link
Member

Fixes https://github.com/SOFware/close_encounters/security/code-scanning/1

To fix the CSRF vulnerability, we need to enable CSRF protection in the ApplicationController class. The best way to do this in a Rails application is to use the protect_from_forgery method with the :exception strategy. This will raise an exception if an invalid CSRF token is encountered, providing a robust defense against CSRF attacks.

Steps to implement the fix:

  1. Add the protect_from_forgery with: :exception line to the ApplicationController class.
  2. Ensure that this change is made in the test/dummy/app/controllers/application_controller.rb file.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@saturnflyer saturnflyer marked this pull request as ready for review September 24, 2024 14:35
@saturnflyer saturnflyer merged commit 11597d5 into main Sep 24, 2024
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant