Unmask Rails Form Authenticity Token (CSRF Token) to get the original token stored in session[:_csrf_token]

unmask_rails_csrf_token.rb

def unmask_authenticity_token(authenticity_token)
  # this must be the same as ActionController::RequestForgeryProtection::AUTHENTICITY_TOKEN_LENGTH
  token_length = 32

  masked_token = Base64.strict_decode64(authenticity_token)

  one_time_pad = masked_token[0...token_length]
  encrypted_csrf_token = masked_token[token_length..-1]

  bytes = encrypted_csrf_token.bytes
  one_time_pad.each_byte.with_index { |b, i| bytes[i] ^= b }

  Base64.strict_encode64(bytes.pack("C*"))
end