AuthenticityToken should provide a method to retrieve the token about rack-protection

[rkh]

How would such a method be provided? We could add a helper to Sinatra, but in general?

[rkh]

Please reopen ticket with Sinatra or whatever you're using.

[arixey]

The source of this issue actually seems to be when session[:csrf] is generated from random_string initially within "accepts?". "accepts?" will fail once but in this POST method it generates random_string that assigns to session[:csrf] that had already effectively assigned nil to params['authenticity_token'] back at the GET. The second time through "accepts?" works more as expected. Maybe there is somewhere to generate session[:csrf] during the GET and not the POST seemingly similar to "session_id" and "tracking".

[arixey]

For example, we can do something like

<input name="authenticity_token" value="<%= session[ :csrf ] ||= SecureRandom.hex( 32 ) %>" 
    type="hidden" />

or an equivalent helper to kick it off. This example assumes SecureRandom. Base.random_string is agreeably a better place than a helper for that, and I think why the original issue opener wanted the token method. However, I think having session[ :csrf ] generated in the same pass as session[ :tracking ] keeps rack-protection out of the view helper business.