Rails CSRF token analyzer

csrf_tokens.rb

def real_csrf_token(token)
  Base64.strict_decode64(token)
end
      
def xor_byte_strings(s1, s2)
  s2_bytes = s2.bytes
  s1.each_byte.with_index { |c1, i| s2_bytes[i] ^= c1 }
  s2_bytes.pack("C*")
end

def unmask_token(masked_token)
  one_time_pad = masked_token[0...AUTHENTICITY_TOKEN_LENGTH]
  encrypted_csrf_token = masked_token[AUTHENTICITY_TOKEN_LENGTH..-1]
  xor_byte_strings(one_time_pad, encrypted_csrf_token)
end

def compare_with_real_token(token, real_token)
  ActiveSupport::SecurityUtils.secure_compare(token, real_csrf_token(real_token))
end