Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to turn off rails protect_from_forgery filter only for json

I have web site built with Rails3 and now I want to implement json API for mobile client access. However, sending json post request from the client because of the protect_from_forgery filter. Because the client will not retrieve any data from the server, there is no way that the client can receive auth_token so I would like to turn off the protect_from_forgery option only for json requests (I thought rails3 does this in default but apparently it does not).

I know similar topic is discussed at here but in that case, he receives auth_token before sending post request.

So my question is turning off the protect_from_forgery only for json is good way of doing this? If yes, how to do so? If no, what is the alternative?

FYI, I use following ajax request

$.ajax({
             type: 'POST',  
             url: "http://www.example.com/login.json",  
             data: { 'email': emailVal, 'password': passwordVal },  
             success: onSuccess,  
             error: onError,  
             dataType: "json"  
});

and I get ActionController::InvalidAuthenticityToken error.

By the way, following curl command works though...

curl -H "Content-Type: application/json" -c cookies.txt -d '{"email": emailVal, "password": passwordVal}' -X POST http://www.example.com/login.json -i
like image 475
katsuya Avatar asked Apr 19 '11 13:04

katsuya


2 Answers

You can just skip the authenticity token check if its a json request

class ApplicationController < ActionController::Base
  skip_before_filter :verify_authenticity_token, if: :json_request?

  def json_request?
    request.format.json?
  end
end
like image 78
John Naegle Avatar answered Oct 14 '22 23:10

John Naegle


Add the code below to your ./app/controllers/application_controller.rb:

protect_from_forgery unless: -> { request.format.json? }
like image 41
leompeters Avatar answered Oct 15 '22 01:10

leompeters