CSRF
all
Does not accept unsafe HTTP requests if the Referer [sic] header is set to a different host.
Combine with NoReferrer to also block remote requests from non-HTTP pages (FTP/HTTPS/…).
# File lib/rack/protection/remote_referrer.rb, line 18 def accepts?(env) safe?(env) or referrer(env) == Request.new(env).host end