Fixed CSRF vulnerability with non-session based authentication

Author: ankane

CHANGELOG.md

@@ -1,5 +1,6 @@
 ## 2.6.1 (unreleased)
 
+- Fixed CSRF vulnerability with non-session based authentication
 - Added `database`, `user`, and `query_hash` options to `reset_query_stats` method
 
 ## 2.6.0 (2020-07-09)

app/controllers/pg_hero/home_controller.rb

@@ -2,7 +2,7 @@ module PgHero
   class HomeController < ActionController::Base
     layout "pg_hero/application"
 
-    protect_from_forgery
+    protect_from_forgery with: :exception
 
     http_basic_authenticate_with name: PgHero.username, password: PgHero.password if PgHero.password