All geek questions in one place

When is the anti-fake ring check box checked?

I am trying to understand when an anti-fake ring marker is generated or inserted into an HTML page. I use Compojure / ring / hiccup, but I think my question is really about the ring. I have no problem as such: I just want to know when and how the anti-fake token is injected.

The function anti-forgery-fieldof is ring.util.anti-forgeryimplemented as follows:

(html (hidden-field "__anti-forgery-token" *anti-forgery-token*)

If I call this function in REPL, I get:

REPL>  (println (anti-forgery-field))
<input id="__anti-forgery-token" name="__anti-forgery-token" type="hidden" value="Unbound: #&apos;ring.middleware.anti-forgery/*anti-forgery-token*" />

Still on REPL, if I try to get this var, I get the same “unbound” variable:

> ring.middleware.anti-forgery/*anti-forgery-token*
=> #object[clojure.lang.Var$Unbound 0x1eae055 "Unbound: #'ring.middleware.anti-forgery/*anti-forgery-token*"]

What I do not understand is what is the meaning of "Unbound" and when it is transformed (by a ring?) Into the actual supplied token. And I especially don’t understand how several users connecting to the website receive, each, a different token (per session).

Is this variable always “unbound”? When / how is he “attached” (if he does?)?

Also, if I have a call session identifier (say, "ring-session = 310678be-9ef6-41a7-a12a-b2417de4a79f"), as I can see, on Clojure REPL (server side), the corresponding anti-fake token value is ?

+4
source share
1 answer

( , , ) . / . , REPL.

, . , , .

, :

https://github.com/weavejester/ring-anti-forgery/blob/master/src/ring/middleware/anti_forgery.clj#L67

(binding [*anti-forgery-token* (session-token request)]
  ;; ...
  )
+4

Source: https://habr.com/ru/post/1674332/

More articles:


All Articles