Hacker News Reader

"The other 'a' cookie, a_xs, is now also deleted on logout. a_xs is used to prevent cross-site request forgery."

Does anyone know how this cookie is used to prevent CSRF?

Rails matches a session csrf token against form data to detect if someone is trying to submit a form without a proper token. This session data is stored in a cookie by default.

This functionality is referenced in the security guide.

http://guides.rubyonrails.org/security.html#csrf-countermeas...

From my reading of that link, in Rails it's not the CSRF token itself that's stored in the cookie, it's the secret used to verify the token. If Facebook is doing the same thing, there would be no need to store the secret after the user has logged out--just generate another secret the next time they log in.

The login form still requires a secret as does any other links that have side effects. I would imagine the like buttons require them to work properly.

Reply on news.ycombinator.com