Base
CSRF
all
en.wikipedia.org/wiki/Cross-site_request_forgery
Does not accept unsafe HTTP requests if the Referer [sic] header is set to a different host.
# File lib/rack/protection/remote_referrer.rb, line 15 def accepts?(env) safe?(env) or referrer(env) == Request.new(env).host end