I came across a website which uses Rails Authenticity token to prevent CSRF attacks. My concern here is that I can see the authenticity token in the source code of the web page. If any other service tries to carry out a CSRF attack and this token is the only thing which prevents it , why can't the attacker service just copy the token and then conduct the attack ?

2 Answers 2


Having a CSRF token in the body of the page is a standard way of preventing CSRF attacks. The token is different for every form that's presented by the application. so when a form is submitted the submission can be checked for the validity of the token.

If an attacker takes a token from a page that he sees essentially that token won't be of use to him as when any other user visits the same page, the token won't be the same.

If you're looking for more information you could look at the OWASP page on CSRF or this post on StackOverflow about the rails specifics.


The problem that CSRF tokens prevent is request forgery. In order to conduct a successful exploit, the attacker would have to receive a copy of the token for the user they're trying to impersonate, not one for themselves. And there's currently no known practical way for an attacker to acquire one of these tokens, when implemented correctly.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .