FreeBSDでRailsのチュートリアルをやってみた

FreeBSDでRailsのチュートリアルをやってみた/CSRF エラー対策/具体的な事例

5.1 具体的な事例

sampleアプリケーションを作成

kiri@smtp:~/work/rails[1192]% rails new sample -B
kiri@smtp:~/work/rails[1193]% cd sample/
kiri@smtp:~/work/rails/sample[1194]% patch < ../patches/Gemfile.diff 
kiri@smtp:~/work/rails/sample[1195]% bundle exec rails webpacker:install

travelsコントローラ/showアクションを作成

kiri@smtp:~/projects/rails/sample[1330]% rails generate controller travels show

POSTを使って送信されたパラメータの取得

POSTを使って送信されたパラメータとは
- form→inputでWeb上から入力されたデータのこと
POSTを使って送信されたパラメータの取得方法
1. 入力フォームのmethod属性に"post"を，action属性に処理するパスを指定
2. コントローラのアクションメソッドでフォームの入力名を参照
3. ルーティングをpostメソッドに変更

POSTを使って送信されたパラメータの取得例

「旅行先」→"dest"，「人数」→"num"として入力フォームを作成

kiri@smtp:~/projects/rails/sample[1341]% cat > public/post.html
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=UTF-8" />
<title>POSTサンプル</title>
</head>
<body>

<p>POSTサンプル</p>
  
<form method="post" action="/travels/show">
 <p>
 旅行先：<input type="text" name="dest" /><br />
 人数：<input type="text" name="num" />人<br />
 <input type="submit" value="送信" />
 </p>
</form>

</body>
</html>
kiri@smtp:~/projects/rails/sample[1342]%

showメソッドを変更

kiri@smtp:~/projects/rails/sample[1342]% diff -u app/controllers/travels_controller.rb.bak app/controllers/travels_controller.rb
--- app/controllers/travels_controller.rb.bak   2024-03-06 15:47:13.000000000 +0900
+++ app/controllers/travels_controller.rb       2024-03-06 17:02:52.759062000 +0900
@@ -1,5 +1,7 @@
+# coding: utf-8
+
 class TravelsController < ApplicationController
   def show
+    render plain: "旅行先 = #{params[:dest]}, 人数 = #{params[:num]}人"
   end
 end
kiri@smtp:~/projects/rails/sample[1343]%

ルーティングを変更

kiri@smtp:~/projects/rails/sample[1343]% diff -u config/routes.rb.bak config/routes.rb              --- config/routes.rb.bak        2024-03-06 16:39:55.000000000 +0900
+++ config/routes.rb    2024-03-06 17:04:24.396404000 +0900
@@ -8,6 +8,6 @@
-  get "travels/show", to: "travels#show"
+  post "travels/show", to: "travels#show"
 end
kiri@smtp:~/projects/rails/sample[1344]%

ウェブサーバーの起動・アクセス

kiri@smtp:~/projects/rails/sample3[1081]% rails server -u webrick
=> Booting WEBrick
=> Rails 6.1.7.6 application starting in development http://localhost:3000
=> Run `bin/rails server --help` for more startup options
[2024-04-10 19:52:04] INFO  WEBrick 1.8.1
[2024-04-10 19:52:04] INFO  ruby 3.3.0 (2023-09-14) [amd64-freebsd15]
[2024-04-10 19:52:04] INFO  WEBrick::HTTPServer#start: pid=51174 port=3000
192.168.1.1 - - [10/Apr/2024:19:52:14 JST] "GET /post.html HTTP/1.1" 200 1269
- -> /post.html
192.168.1.1 - - [10/Apr/2024:19:52:14 JST] "GET /favicon.ico HTTP/1.1" 200 0
http://localhost:3000/post.html -> /favicon.ico
192.168.1.1 - - [10/Apr/2024:19:52:14 JST] "GET /mini-profiler-resources/includes.css?v=90a68676a0c0d704b4438ca3f27d46c4 HTTP/1.1" 304 0
http://localhost:3000/post.html -> /mini-profiler-resources/includes.css?v=90a68676a0c0d704b4438ca3f27d46c4
192.168.1.1 - - [10/Apr/2024:19:52:14 JST] "GET /mini-profiler-resources/vendor.js?v=90a68676a0c0d704b4438ca3f27d46c4 HTTP/1.1" 304 0
http://localhost:3000/post.html -> /mini-profiler-resources/vendor.js?v=90a68676a0c0d704b4438ca3f27d46c4
192.168.1.1 - - [10/Apr/2024:19:52:14 JST] "POST /mini-profiler-resources/results HTTP/1.1" 200 1906
http://localhost:3000/post.html -> /mini-profiler-resources/results
192.168.1.1 - - [10/Apr/2024:19:52:14 JST] "POST /mini-profiler-resources/results HTTP/1.1" 200 1317
http://localhost:3000/post.html -> /mini-profiler-resources/results
192.168.1.1 - - [10/Apr/2024:19:52:14 JST] "POST /mini-profiler-resources/results HTTP/1.1" 200 1316
http://localhost:3000/post.html -> /mini-profiler-resources/results
192.168.1.1 - - [10/Apr/2024:19:52:14 JST] "POST /mini-profiler-resources/results HTTP/1.1" 200 1320
http://localhost:3000/post.html -> /mini-profiler-resources/results
192.168.1.1 - - [10/Apr/2024:19:52:14 JST] "POST /mini-profiler-resources/results HTTP/1.1" 200 5711
http://localhost:3000/post.html -> /mini-profiler-resources/results
192.168.1.1 - - [10/Apr/2024:19:52:14 JST] "POST /mini-profiler-resources/results HTTP/1.1" 200 2535
http://localhost:3000/post.html -> /mini-profiler-resources/results
Started POST "/travels/show" for 192.168.1.1 at 2024-04-10 19:52:17 +0900
Cannot render console from 192.168.1.1! Allowed networks: 127.0.0.0/127.255.255.255, ::1
   (0.6ms)  SELECT sqlite_version(*)
Processing by TravelsController#show as HTML
  Parameters: {"dest"=>"北海道", "num"=>"2"}
Can't verify CSRF token authenticity.
Completed 422 Unprocessable Entity in 1ms (ActiveRecord: 0.0ms | Allocations: 666)


  
ActionController::InvalidAuthenticityToken (ActionController::InvalidAuthenticityToken):
  
actionpack (6.1.7.6) lib/action_controller/metal/request_forgery_protection.rb:211:in `handle_unverified_request'
actionpack (6.1.7.6) lib/action_controller/metal/request_forgery_protection.rb:243:in `handle_unverified_request'
actionpack (6.1.7.6) lib/action_controller/metal/request_forgery_protection.rb:238:in `verify_authenticity_token'
activesupport (6.1.7.6) lib/active_support/callbacks.rb:427:in `block in make_lambda'
activesupport (6.1.7.6) lib/active_support/callbacks.rb:198:in `block (2 levels) in halting'
actionpack (6.1.7.6) lib/abstract_controller/callbacks.rb:34:in `block (2 levels) in <module:Callbacks>'
activesupport (6.1.7.6) lib/active_support/callbacks.rb:199:in `block in halting'
activesupport (6.1.7.6) lib/active_support/callbacks.rb:512:in `block in invoke_before'
activesupport (6.1.7.6) lib/active_support/callbacks.rb:512:in `each'
activesupport (6.1.7.6) lib/active_support/callbacks.rb:512:in `invoke_before'
activesupport (6.1.7.6) lib/active_support/callbacks.rb:115:in `block in run_callbacks'
activesupport (6.1.7.6) lib/active_support/callbacks.rb:137:in `run_callbacks'
actionpack (6.1.7.6) lib/abstract_controller/callbacks.rb:41:in `process_action'
actionpack (6.1.7.6) lib/action_controller/metal/rescue.rb:22:in `process_action'
actionpack (6.1.7.6) lib/action_controller/metal/instrumentation.rb:34:in `block in process_action'
activesupport (6.1.7.6) lib/active_support/notifications.rb:203:in `block in instrument'
activesupport (6.1.7.6) lib/active_support/notifications/instrumenter.rb:24:in `instrument'
activesupport (6.1.7.6) lib/active_support/notifications.rb:203:in `instrument'
actionpack (6.1.7.6) lib/action_controller/metal/instrumentation.rb:33:in `process_action'
actionpack (6.1.7.6) lib/action_controller/metal/params_wrapper.rb:249:in `process_action'
activerecord (6.1.7.6) lib/active_record/railties/controller_runtime.rb:27:in `process_action'
actionpack (6.1.7.6) lib/abstract_controller/base.rb:165:in `process'
actionview (6.1.7.6) lib/action_view/rendering.rb:39:in `process'
actionpack (6.1.7.6) lib/action_controller/metal.rb:190:in `dispatch'
actionpack (6.1.7.6) lib/action_controller/metal.rb:254:in `dispatch'
actionpack (6.1.7.6) lib/action_dispatch/routing/route_set.rb:50:in `dispatch'
actionpack (6.1.7.6) lib/action_dispatch/routing/route_set.rb:33:in `serve'
actionpack (6.1.7.6) lib/action_dispatch/journey/router.rb:50:in `block in serve'
actionpack (6.1.7.6) lib/action_dispatch/journey/router.rb:32:in `each'
actionpack (6.1.7.6) lib/action_dispatch/journey/router.rb:32:in `serve'
actionpack (6.1.7.6) lib/action_dispatch/routing/route_set.rb:842:in `call'
rack (2.2.8) lib/rack/tempfile_reaper.rb:15:in `call'
rack (2.2.8) lib/rack/etag.rb:27:in `call'
rack (2.2.8) lib/rack/conditional_get.rb:40:in `call'
rack (2.2.8) lib/rack/head.rb:12:in `call'
actionpack (6.1.7.6) lib/action_dispatch/http/permissions_policy.rb:22:in `call'
actionpack (6.1.7.6) lib/action_dispatch/http/content_security_policy.rb:19:in `call'
rack (2.2.8) lib/rack/session/abstract/id.rb:266:in `context'
rack (2.2.8) lib/rack/session/abstract/id.rb:260:in `call'
actionpack (6.1.7.6) lib/action_dispatch/middleware/cookies.rb:697:in `call'
activerecord (6.1.7.6) lib/active_record/migration.rb:601:in `call'
actionpack (6.1.7.6) lib/action_dispatch/middleware/callbacks.rb:27:in `block in call'
activesupport (6.1.7.6) lib/active_support/callbacks.rb:98:in `run_callbacks'
actionpack (6.1.7.6) lib/action_dispatch/middleware/callbacks.rb:26:in `call'
actionpack (6.1.7.6) lib/action_dispatch/middleware/executor.rb:14:in `call'
actionpack (6.1.7.6) lib/action_dispatch/middleware/actionable_exceptions.rb:18:in `call'
actionpack (6.1.7.6) lib/action_dispatch/middleware/debug_exceptions.rb:29:in `call'
web-console (4.2.1) lib/web_console/middleware.rb:132:in `call_app'
web-console (4.2.1) lib/web_console/middleware.rb:19:in `block in call'
web-console (4.2.1) lib/web_console/middleware.rb:17:in `catch'
web-console (4.2.1) lib/web_console/middleware.rb:17:in `call'
actionpack (6.1.7.6) lib/action_dispatch/middleware/show_exceptions.rb:33:in `call'
railties (6.1.7.6) lib/rails/rack/logger.rb:37:in `call_app'
railties (6.1.7.6) lib/rails/rack/logger.rb:26:in `block in call'
activesupport (6.1.7.6) lib/active_support/tagged_logging.rb:99:in `block in tagged'
activesupport (6.1.7.6) lib/active_support/tagged_logging.rb:37:in `tagged'
activesupport (6.1.7.6) lib/active_support/tagged_logging.rb:99:in `tagged'
railties (6.1.7.6) lib/rails/rack/logger.rb:26:in `call'
sprockets-rails (3.4.2) lib/sprockets/rails/quiet_assets.rb:13:in `call'
actionpack (6.1.7.6) lib/action_dispatch/middleware/remote_ip.rb:81:in `call'
actionpack (6.1.7.6) lib/action_dispatch/middleware/request_id.rb:26:in `call'
rack (2.2.8) lib/rack/method_override.rb:24:in `call'
rack (2.2.8) lib/rack/runtime.rb:22:in `call'
activesupport (6.1.7.6) lib/active_support/cache/strategy/local_cache_middleware.rb:29:in `call'
actionpack (6.1.7.6) lib/action_dispatch/middleware/executor.rb:14:in `call'
actionpack (6.1.7.6) lib/action_dispatch/middleware/static.rb:24:in `call'
rack (2.2.8) lib/rack/sendfile.rb:110:in `call'
actionpack (6.1.7.6) lib/action_dispatch/middleware/host_authorization.rb:148:in `call'
rack-mini-profiler (3.1.1) lib/mini_profiler.rb:413:in `call'
webpacker (5.4.4) lib/webpacker/dev_server_proxy.rb:25:in `perform_request'
rack-proxy (0.7.7) lib/rack/proxy.rb:87:in `call'
railties (6.1.7.6) lib/rails/engine.rb:539:in `call'
rack (2.2.8) lib/rack/handler/webrick.rb:95:in `service'
webrick (1.8.1) lib/webrick/httpserver.rb:140:in `service'
webrick (1.8.1) lib/webrick/httpserver.rb:96:in `run'
webrick (1.8.1) lib/webrick/server.rb:310:in `block in start_thread'
192.168.1.1 - - [10/Apr/2024:19:52:17 JST] "POST /travels/show HTTP/1.1" 422 110418
http://localhost:3000/post.html -> /travels/show
192.168.1.1 - - [10/Apr/2024:19:52:18 JST] "GET /favicon.ico HTTP/1.1" 200 0
http://localhost:3000/travels/show -> /favicon.ico

⇒ "Can't verify CSRF token authenticity." で落ちる

FreeBSDでRailsのチュートリアルをやってみた/CSRF エラー対策/具体的な事例