Merge pull request #24641 from rafaelfranca/fix-per-form-token-with-full-url

Discart the schema and host information when building the per-form token

actionpack/lib/action_controller/metal/request_forgery_protection.rb

@@ -405,7 +405,8 @@ def valid_request_origin?
       end
 
       def normalize_action_path(action_path)
-        action_path.split('?').first.to_s.chomp('/')
+        uri = URI.parse(action_path)
+        uri.path.chomp('/')
       end
   end
 end

actionpack/test/controller/request_forgery_protection_test.rb

@@ -781,6 +781,19 @@ def test_ignores_trailing_slash_during_generation
     assert_response :success
   end
 
+  def test_ignores_origin_during_generation
+    get :index, params: {form_path: 'https://example.com/per_form_tokens/post_one/'}
+
+    form_token = assert_presence_and_fetch_form_csrf_token
+
+    # This is required because PATH_INFO isn't reset between requests.
+    @request.env['PATH_INFO'] = '/per_form_tokens/post_one'
+    assert_nothing_raised do
+      post :post_one, params: {custom_authenticity_token: form_token}
+    end
+    assert_response :success
+  end
+
   def test_ignores_trailing_slash_during_validation
     get :index