Can´t use: [:escaped_params] ?

[baelter]

Shouldn't :escaped_params be added here: https://github.com/sinatra/sinatra/blob/master/rack-protection/lib/rack/protection.rb#L33 ??

[dentarg]

Seems like it is intentionally not included by use Rack::Protection, if that's what you mean: https://github.com/sinatra/sinatra/blob/v2.0.8.1/rack-protection/README.md#cross-site-request-forgery

A bit hard to follow, but I think background for that exist in

• Sinatra or sinatra-contrib has to do path traversal prevention #310
• Don't escape parameters by default in included rack-protection (issue #310) #361
• HTTP_VERSION in SessionHijacking rack-protection#6

[baelter]

I'm down with that, but it can't be activated with

set(:protection, use: [:escaped_params], escape: [:html]

Bonus quirk: the escape options passed above are used if I activate it with

use Rack::Protection::EscapedParams

[jkowens]

@baelter I think you are correct, it should be added there and off by default. Can you send up a PR to do that?