{"record":{"id":"9ff625f1d32ef895","repo":"padrino/padrino-framework","slug":"protect-from-csrf-is-activated-but-sessions-s","errorCode":null,"errorMessage":"`protect_from_csrf` is activated, but `sessions` seem to be off. To enable csrf protection, use:\n\n    enable :sessions\n\nor deactivate protect_from_csrf:\n\n    disable :protect_from_csrf\n\nIf you use a different session store, ignore this warning using:\n\n    # in boot.rb:\n    Padrino::IGNORE_CSRF_SETUP_WARNING = true","messagePattern":"`protect_from_csrf` is activated, but `sessions` seem to be off\\. To enable csrf protection, use:\n\n    enable :sessions\n\nor deactivate protect_from_csrf:\n\n    disable :protect_from_csrf\n\nIf you use a different session store, ignore this warning using:\n\n    # in boot\\.rb:\n    Padrino::IGNORE_CSRF_SETUP_WARNING = true","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"padrino-core/lib/padrino-core/application/application_setup.rb","lineNumber":187,"sourceCode":"      end\n\n      # returns the options used in the builder for csrf protection setup\n      def options_for_csrf_protection_setup\n        options = { logger: logger }\n        if report_csrf_failure? || allow_disabled_csrf?\n          options.merge!(\n            reaction: :report,\n            report_key: 'protection.csrf.failed'\n          )\n        end\n        options\n      end\n\n      # warn if the protect_from_csrf is active but sessions are not\n      def check_csrf_protection_dependency\n        return unless protect_from_csrf? && !sessions? && !defined?(Padrino::IGNORE_CSRF_SETUP_WARNING)\n\n        warn(<<~ERROR)\n          `protect_from_csrf` is activated, but `sessions` seem to be off. To enable csrf\n          protection, use:\n\n              enable :sessions\n\n          or deactivate protect_from_csrf:\n\n              disable :protect_from_csrf\n\n          If you use a different session store, ignore this warning using:\n\n              # in boot.rb:\n              Padrino::IGNORE_CSRF_SETUP_WARNING = true\n        ERROR\n      end\n    end\n  end\nend","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/padrino/padrino-framework/blob/167044f3d56b2bce12f943eb826fdb0b0ea94375/padrino-core/lib/padrino-core/application/application_setup.rb#L169-L205","documentation":"During application setup, check_csrf_protection_dependency warns (via Kernel#warn, not an exception) when protect_from_csrf is enabled but sessions are not. CSRF token verification depends on a session store to hold and compare tokens, so the protection cannot function without sessions; the warning offers three remedies and can be silenced with Padrino::IGNORE_CSRF_SETUP_WARNING.","triggerScenarios":"An app class with enable :protect_from_csrf but no enable :sessions (Sinatra-style sessions default to off), booting without Padrino::IGNORE_CSRF_SETUP_WARNING defined anywhere.","commonSituations":"Apps that handle sessions in custom middleware (Rack::Session::Pool, Redis stores) where the settings check is a false positive; upgrades where CSRF protection was turned on for the first time; accidentally running disable :sessions.","solutions":["Enable sessions in the app class so CSRF tokens have a store: enable :sessions before enable :protect_from_csrf","For API-only apps that do not want CSRF, call disable :protect_from_csrf","If sessions are provided by your own middleware, set Padrino::IGNORE_CSRF_SETUP_WARNING = true in boot.rb before the app loads"],"exampleFix":"# before\nclass MyApp < Padrino::Application\n  enable :protect_from_csrf\nend\n\n# after\nclass MyApp < Padrino::Application\n  enable :sessions\n  enable :protect_from_csrf\nend","handlingStrategy":"validation","validationCode":"# mirror the framework condition during app setup\nif respond_to?(:protect_from_csrf?) && protect_from_csrf? && !sessions?\n  warn 'enable :sessions or disable :protect_from_csrf'\nend","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Enable sessions whenever you enable protect_from_csrf","For custom session middleware, set Padrino::IGNORE_CSRF_SETUP_WARNING = true in boot.rb before apps load","Treat this warning as a security defect, not log noise"],"tags":["padrino","csrf","sessions","security","boot-warning"],"backgroundTag":"csrf-session-misconfiguration","analyzedSha":"167044f3d56b2bce12f943eb826fdb0b0ea94375","analyzedAt":"2026-08-23T12:41:41.049Z","schemaVersion":2},"datasetVersion":"2026-08-23T16:17:53.355Z"}