Rails: Can’t verify CSRF token authenticity when making a POST request

by

Cross site request forgery (CSRF/XSRF) is when a malicious web page tricks users into performing a request that is not intended for example by using bookmarklets, iframes or just by creating a page which is visually similar enough to fool users.

The Rails CSRF protection is made for “classical” web apps – it simply gives a degree of assurance that the request originated from your own web app. A CSRF token works like a secret that only your server knows – Rails generates a random token and stores it in the session. Your forms send the token via a hidden input and Rails verifies that any non GET request includes a token that matches what is stored in the session.

However in an API thats intended to be used cross site and even serve non-browser clients its not very useful due to the problems with cross-domain cookies and providing CSRF tokens.

In that case you should use a token based strategy of authenticating API requests with an API key and secret since you are verifying that the request comes from an approved API client – not from your own app.

You can deactivate CSRF as pointed out by @dcestari:

class ApiController < ActionController::Base
  protect_from_forgery with: :null_session
end

Updated. In Rails 5 you can generate API only applications by using the --api option:

rails new appname --api

They do not include the CSRF middleware and many other components that are superflouus.

More Related Contents:

  1. Ruby on rails Failed to precompile
  2. How to prevent browser page caching in Rails
  3. ActiveModel::ForbiddenAttributesError when creating new user
  4. Ruby on Rails – Import Data from a CSV file
  5. Rails nested form with has_many :through, how to edit attributes of join model?
  6. A cron job for rails: best practices?
  7. Rails: Installing PG gem on OS X – failure to build native extension
  8. How to change Rails 3 server default port in develoment?
  9. Clean way to find ActiveRecord objects by id in the order specified
  10. How to extract URL parameters from a URL with Ruby or Rails?
  11. Rails Polymorphic Association with multiple associations on the same model
  12. Rails config.assets.precompile setting to process all CSS and JS files in app/assets
  13. Rails, Devise authentication, CSRF issue
  14. Rails: Get Client IP address
  15. HEROKU – cannot run git push heroku master [duplicate]
  16. Error when running rails app – ExecJS::RuntimeError
  17. How do I handle too long index names in a Ruby on Rails ActiveRecord migration?
  18. rails4 unknown encoding name – CP720
  19. What is the difference between Ruby and Ruby on Rails?
  20. How can I use option “–bare” in Rails 3.1 for CoffeeScript?
  21. What’s the difference between belongs_to and has_one?
  22. What do the &,
  23. nokogiri gem installation error
  24. How to edit or write on existing PDF with Ruby?
  25. Rails 4 – Gem::LoadError: Specified ‘mysql2’ for database adapter, but the gem is not loaded
  26. Rails: FATAL – Peer authentication failed for user (PG::Error)
  27. What is the difference between Gemfile and Gemfile.lock in Ruby on Rails
  28. Passing variables inside rails internationalization yml file
  29. Parametrized get request in Ruby?
  30. Rails best way to get previous and next active record object

Leave a Comment