debug-invalid-csrf-token.rb

{
  inputs:
    [params[:authenticity_token], request.x_csrf_token].map do |token|
      Base64.urlsafe_decode64(token)
    end.map do |token|
      xor_byte_strings(
        token[0...AUTHENTICITY_TOKEN_LENGTH],
        token[AUTHENTICITY_TOKEN_LENGTH..-1]
      )
    end,
  secrets:
    Base64
      .urlsafe_decode64(session[:_csrf_token])
      .then do |real_csrf_token|
        [
          real_csrf_token,
          OpenSSL::HMAC.digest(
            OpenSSL::Digest::SHA256.new,
            real_csrf_token,
            "!real_csrf_token"
          ),
          OpenSSL::HMAC.digest(
            OpenSSL::Digest::SHA256.new,
            real_csrf_token,
            [
              request.path.chomp("/"),
              request.request_method.downcase
            ].join("#")
          )
        ]
      end
}