rails – “WARNING: Can’t verify CSRF token authenticity” for json devise requests

by

EDIT:

In Rails 4 I now use what @genkilabs suggests in the comment below:

protect_from_forgery with: :null_session, if: Proc.new { |c| c.request.format == 'application/json' }

Which, instead of completely turning off the built in security, kills off any session that might exist when something hits the server without the CSRF token.

skip_before_filter :verify_authenticity_token, :if => Proc.new { |c| c.request.format == 'application/json' }

This would turn off the CSRF check for json posts/puts that have properly been marked as such.

For example, in iOS setting the following to your NSURLRequest where “parameters” are your parameters:

[request setHTTPMethod:@"POST"];

[request setValue:@"application/json" 
       forHTTPHeaderField:@"content-type"];

[request setValue:@"application/json" 
       forHTTPHeaderField:@"accept"];

[request setHTTPBody:[NSData dataWithBytes:[parameters UTF8String] 
                                            length:[parameters length]]];

More Related Contents:

  1. Turn off CSRF token in rails 3
  2. Rails 3.1: Engine vs. Mountable App
  3. “Who’s Online” using Devise in Rails
  4. rails 3 activerecord order – what is the proper sql injection work around?
  5. rails:3 Devise signup Filter chain halted as :require_no_authentication rendered or redirected
  6. No route matches “/users/sign_out” devise rails 3
  7. rails error, couldn’t parse YAML
  8. Rails – Could not find a JavaScript runtime?
  9. Share database between 2 apps in Heroku
  10. Undefined method ‘task’ using Rake 0.9.0
  11. Devise form within a different controller
  12. Disable HTML escaping in erb templates
  13. Devise limit one session per user at a time
  14. rmagick gem install “Can’t find Magick-config”
  15. Can we call a Controller’s method from a view (as we call from helper ideally)?
  16. Rails Engine – Gems dependencies, how to load them into the application?
  17. Rails 3 library not loading until require
  18. using Liquid variables inside of a liquid tag call
  19. Rails naming convention for join table
  20. Rails 3 render action from another controller
  21. Error “…cannot load such file — mysql2/2.0/mysql2 (LoadError)”. On Windows XP with Ruby 2.0.0
  22. Rails: FATAL – Peer authentication failed for user (PG::Error)
  23. How to rename rails 4 app?
  24. Rails 3 – how do I avoid database altogether?
  25. How to make Devise redirect after confirmation
  26. Rails 3 – upload files to public directory
  27. ActiveRecord Find All not sorting by ID?
  28. Rails devise: user_signed_in? not working
  29. Character encoding issue exporting rails data to CSV
  30. Customizing Devise error messages in Rails 3?

Leave a Comment