padrino/padrino-framework · warning

`protect_from_csrf` is activated, but `sessions` seem to be

Error message

`protect_from_csrf` is activated, but `sessions` seem to be off. To enable csrf protection, use:

    enable :sessions

or deactivate protect_from_csrf:

    disable :protect_from_csrf

If you use a different session store, ignore this warning using:

    # in boot.rb:
    Padrino::IGNORE_CSRF_SETUP_WARNING = true

What it means

During application setup, check_csrf_protection_dependency warns (via Kernel#warn, not an exception) when protect_from_csrf is enabled but sessions are not. CSRF token verification depends on a session store to hold and compare tokens, so the protection cannot function without sessions; the warning offers three remedies and can be silenced with Padrino::IGNORE_CSRF_SETUP_WARNING.

Source

Thrown at padrino-core/lib/padrino-core/application/application_setup.rb:187

      end

      # returns the options used in the builder for csrf protection setup
      def options_for_csrf_protection_setup
        options = { logger: logger }
        if report_csrf_failure? || allow_disabled_csrf?
          options.merge!(
            reaction: :report,
            report_key: 'protection.csrf.failed'
          )
        end
        options
      end

      # warn if the protect_from_csrf is active but sessions are not
      def check_csrf_protection_dependency
        return unless protect_from_csrf? && !sessions? && !defined?(Padrino::IGNORE_CSRF_SETUP_WARNING)

        warn(<<~ERROR)
          `protect_from_csrf` is activated, but `sessions` seem to be off. To enable csrf
          protection, use:

              enable :sessions

          or deactivate protect_from_csrf:

              disable :protect_from_csrf

          If you use a different session store, ignore this warning using:

              # in boot.rb:
              Padrino::IGNORE_CSRF_SETUP_WARNING = true
        ERROR
      end
    end
  end
end

View on GitHub (pinned to 167044f3d5)

Solutions

1. Enable sessions in the app class so CSRF tokens have a store: enable :sessions before enable :protect_from_csrf
2. For API-only apps that do not want CSRF, call disable :protect_from_csrf
3. If sessions are provided by your own middleware, set Padrino::IGNORE_CSRF_SETUP_WARNING = true in boot.rb before the app loads

Example fix

# before
class MyApp < Padrino::Application
  enable :protect_from_csrf
end

# after
class MyApp < Padrino::Application
  enable :sessions
  enable :protect_from_csrf
end

# mirror the framework condition during app setup
if respond_to?(:protect_from_csrf?) && protect_from_csrf? && !sessions?
  warn 'enable :sessions or disable :protect_from_csrf'
end

When it happens

Trigger: An app class with enable :protect_from_csrf but no enable :sessions (Sinatra-style sessions default to off), booting without Padrino::IGNORE_CSRF_SETUP_WARNING defined anywhere.

Common situations: Apps that handle sessions in custom middleware (Rack::Session::Pool, Redis stores) where the settings check is a false positive; upgrades where CSRF protection was turned on for the first time; accidentally running disable :sessions.

Related errors

• Please, do not use `register` on Padrino::Application object
• No logging configuration for :#{config_level} found, falling

AI-assisted analysis of padrino/padrino-framework@167044f3d5 (2026-08-23). Data as JSON: /api/errors/9ff625f1d32ef895. Report an issue: GitHub.