How does CSRF protection work in Rails forms?

How does CSRF protection work in Rails forms?

CSRF, or Cross-Site Request Forgery, is a security feature in Rails that prevents unauthorized commands from being transmitted from a user that the web application trusts. In Rails forms, this is implemented using a CSRF token.

What is a CSRF token?

A CSRF token is a unique, secret, and unpredictable value that is generated by the server and included in forms. When the form is submitted, the server checks the token to ensure it matches the one stored in the user's session.

How do I add a CSRF token to my Rails form?

In Rails, you can add a CSRF token to your form by using the form_with or form_for helpers, which automatically include the token in the form.

What happens if the CSRF token is missing or invalid?

If the CSRF token is missing or invalid, Rails will reject the request and respond with a 422 Unprocessable Entity status, preventing the action from being executed.