module Turbolinks::XDomainBlocker
Changes the response status to 403 Forbidden if all of these conditions are true:
-
The current request originated from Turbolinks
-
The request is being redirected to a different domain
Private Instance Methods
abort_xdomain_redirect()
click to toggle source
# File lib/turbolinks/x_domain_blocker.rb, line 13 def abort_xdomain_redirect to_uri = response.headers['Location'] || "" current = request.headers['X-XHR-Referer'] || "" unless to_uri.blank? || current.blank? || same_origin?(current, to_uri) self.status = 403 end end
same_origin?(a, b)
click to toggle source
# File lib/turbolinks/x_domain_blocker.rb, line 7 def same_origin?(a, b) a = URI.parse URI.escape(a) b = URI.parse URI.escape(b) [a.scheme, a.host, a.port] == [b.scheme, b.host, b.port] end