ruby script/plugin install http://secure-action-plugin.googlecode.com/svn/

Usage
-----

Call the secure_actions method in the controllers you'd like to secure. secure_actions accepts :all or :only|:except => [:action].

class AccountController < ApplicationController

  secure_actions :only => [:change_email]
  # or secure_actions :except => [:index, :foo]
  # or secure_actions :all

  def change_email
    user = logged_in_user
    user.email = params[:email]
    user.save
  end

end

This above code adds a signature to all URLs generated that point to that action, and creates a filter that verifies the signature before running the action. It ensures that the correct user has generated the form or link for the action to be executed, preventing malicious URLs from harming your users.

There is currently no advanced documentation for this plugin.