Disabled CSRF (ARCH6125)

Key ruby.security.disabled-csrf · Severity warning · Category security · CWE CWE-352

Turning off CSRF protection lets state-changing requests be forged from another site. Keep CSRF token verification enabled on browser-facing endpoints.

Incorrect

class TransfersController < ApplicationController
  skip_before_action :verify_authenticity_token

  def create
    Account.transfer(params[:to], params[:amount])
  end
end

Correct

class TransfersController < ApplicationController
  protect_from_forgery with: :exception

  def create
    Account.transfer(params[:to], params[:amount])
  end
end

Fix

Remove skip_before_action :verify_authenticity_token and keep protect_from_forgery.