<!DOCTYPE html>
<html lang="<%= I18n.locale %>">
<head>
  <meta charset="utf-8">
  <meta http-equiv="X-UA-Compatible" content="IE=edge" />
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>BadgeApp</title>
  <%= favicon_link_tag %>
  <%= stylesheet_link_tag    'application', media: 'all' %>
  <%= javascript_include_tag 'application', defer: true %>
  <%= auto_discovery_link_tag :atom, { controller: 'projects', action: 'feed' }, { title: t('feed_title') } %>
  <%= csrf_meta_tags %>
</head>
<body>
  <%= render 'layouts/header' %>
  <% flash.each do |message_type, message| %>
    <div class="alert alert-<%= message_type %>"><%= message %></div>
  <% end %>

  <div class="container container_margins">
  <%= yield %>
  </div>

  <%= render 'layouts/footer' %>
  <%= debug(params) if Rails.env.development? %>
</body>
</html>

<!DOCTYPE html>
<html lang="<%= I18n.locale %>">
<head>
  <meta charset="utf-8">
  <meta http-equiv="X-UA-Compatible" content="IE=edge" />
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <%= csrf_meta_tags %>
  <title>BadgeApp</title>
  <%= favicon_link_tag %>
  <%= stylesheet_link_tag    'application', media: 'all' %>
  <%= javascript_include_tag 'application', defer: true %>
  <%= auto_discovery_link_tag :atom, { controller: 'projects', action: 'feed' }, { title: t('feed_title') } %>
</head>
<body>
  <%= render 'layouts/header' %>
  <% flash.each do |message_type, message| %>
    <div class="alert alert-<%= message_type %>"><%= message %></div>
  <% end %>

  <div class="container container_margins">
  <%= yield %>
  </div>

  <%= render 'layouts/footer' %>
  <%= debug(params) if Rails.env.development? %>
</body>
</html>

Move CSRF meta tags to very early in application HTML
Hardening: Move CSRF meta tags to very early in application HTML

Move the CSRF meta tags so they are very early in sent HTML.
This is a hardening measure; this way, even if there's an
error in the later code (e.g., that allows an attacker to insert a
comment or other text), it cannot override or control the CSRF meta tag
because the CSRF meta tag occurs first.

For more about this, see the "Dangling markup injection" section of
"Postcards from the post-XSS world" by Michal Zalewski:
http://lcamtuf.coredump.cx/postxss/

This does have a trivial downside: it interferes slightly with compression,
because now we have random data inserted somewhat early.
This isn't serious, indeed, it's unlikely to be noticed by actual users,
and we highly rank security.

Signed-off-by: David A. Wheeler <9ae72d22d8b894b865a7a496af4fab6320e6abb2@dwheeler.com>
