Turn off CSRF token in rails 3

Question

I have a rails app that serves some APIs to an iPhone application. I want to be able to simply post on a resource without minding on get the correct CSRF token. I tried some methods that I see here in stackoverflow but it seems they no longer work on rails 3.

Thank you for helping me.

score 198 · Accepted Answer · edited Dec 21 '17 at 22:50

198

In the controller where you want to disable CSRF the check:

skip_before_action :verify_authenticity_token

Or to disable it for everything except a few methods:

skip_before_action :verify_authenticity_token, :except => [:update, :create]

Or to disable only specified methods:

skip_before_action :verify_authenticity_token, :only => [:custom_auth, :update]

More info: RoR Request Forgery Protection

edited Dec 21 '17 at 22:50

Dorian

22,759
8
120
116

answered Apr 14 '11 at 20:36

Mike Lewis

63,433
20
141
111

2

This is the correct answer for apps that have a mix of regular browser-accessible forms and API endpoints. The answer from Markus Proske would be correct if you were absolutely sure you were not going to have any browser-accessible forms in your app. – Asfand Qazi Jul 09 '14 at 10:44
Where exactly does this go? What if the controller part of some gem? – Throw Away Account Apr 05 '17 at 08:29
May I ask you if you can answer this very similar question? https://stackoverflow.com/questions/50159847/single-page-application-and-csrf-token – May 06 '18 at 19:42

Markus Proske · Answer 2 · 2011-04-14T20:48:21.993

108

In Rails3 you can disable the csrf token in your controller for particular methods:

protect_from_forgery :except => :create

edited Apr 14 '11 at 20:48

answered Apr 14 '11 at 20:38

Markus Proske

3,356
3
24
32

12

For anyone reading, note that this is what should go in `ApplicationController`. Mike Lewis' response below (`skip_before_filter :verify_authenticity_token`) is how to disable it on per-controller basis, assuming that controller inherits from `ApplicationController`. – NudeCanalTroll Feb 16 '13 at 21:04
Seems this is unsafe http://stackoverflow.com/questions/10676018/security-safe-to-disable-csrf-tokens-for-json-rails-calls. What do you think? is it? – sites May 13 '13 at 03:49
@NudeCanalTroll you mean putting this in the controller where I want it wont work? – DivinesLight May 28 '13 at 10:27
May I ask you if you can answer this very similar question? https://stackoverflow.com/questions/50159847/single-page-application-and-csrf-token – May 06 '18 at 19:43

score 33 · Answer 3 · edited Sep 27 '16 at 11:09

33

With Rails 4, you now have the option to write in skip_before_action instead of skip_before_filter.

# Works in Rails 4 and 5
skip_before_action :verify_authenticity_token

or

# Works in Rails 3 and 4 (deprecated in Rails 4 and removed in Rails 5)
skip_before_filter :verify_authenticity_token

edited Sep 27 '16 at 11:09

Jonas Schubert Erlandsson

3,910
1
24
37

answered Sep 08 '13 at 22:49

thank_you

11,001
19
101
185

1

What's the difference? – Adam D. Ruppe Feb 25 '15 at 13:49
May I ask you if you can answer this very similar question? https://stackoverflow.com/questions/50159847/single-page-application-and-csrf-token – May 06 '18 at 19:43
John Sam, when I have time I'll try and get around to it. – thank_you May 07 '18 at 15:24

Turn off CSRF token in rails 3

3 Answers3

Linked