---
id: 1954
title: "Mitigating CWE-352: Cross-Site Request Forgery in Ruby Applications"
source_domain: hackerone.com
source_url: "https://www.hackerone.com/blog/mitigating-cwe-352-cross-site-request-forgery-ruby-applications"
published_at: "2024-01-23T06:38:10Z"
tags: ["ruby", "web-security", "csrf", "rails", "cwe-352"]
phying_url: "https://phying.com/item/1954"
lang: en
---

# Mitigating CWE-352: Cross-Site Request Forgery in Ruby Applications

## Summary

A guide to CSRF (CWE-352) in Ruby apps: verify Rails authenticity tokens, keep side effects off GET requests, and audit skip_before_action bypasses, then fix with proper token validation.

## Intelligence Metadata

- **Sources:** hackerone.com
- **Published:** 2024-01-23T06:38:10Z
- **Original:** https://www.hackerone.com/blog/mitigating-cwe-352-cross-site-request-forgery-ruby-applications
- **Phying News:** https://phying.com/item/1954