rack-protection-http-origin.html

<dl class="rdoc-list note-list"><dt>Prevented attack
<dd>
<p>CSRF</p>
</dd><dt>Supported browsers
<dd>
<p>Google Chrome 2, Safari 4 and later</p>
</dd><dt>More infos
<dd>
<p><a href="http://en.wikipedia.org/wiki/Cross-site_request_forgery">en.wikipedia.org/wiki/Cross-site_request_forgery</a> <a href="http://tools.ietf.org/html/draft-abarth-origin">tools.ietf.org/html/draft-abarth-origin</a></p>
</dd></dl>

<p>Does not accept unsafe HTTP requests when value of Origin HTTP request header does not match default or permitted URIs.</p>

<p>If you want to permit a specific domain, you can pass in as the ‘:permitted_origins` option:</p>

<pre class="ruby"><span class="ruby-identifier">use</span> <span class="ruby-constant">Rack</span><span class="ruby-operator">::</span><span class="ruby-constant">Protection</span>, <span class="ruby-value">permitted_origins:</span> [<span class="ruby-string">&quot;http://localhost:3000&quot;</span>, <span class="ruby-string">&quot;http://127.0.01:3000&quot;</span>]
</pre>

<p>The ‘:allow_if` option can also be set to a proc to use custom allow/deny logic.</p>