I'm asking this because I feel that it's making my life overly complicated when I start communicating with rails using ajax or flash.
I know it's nice to protect against CSRF, but couldn't I just check the referer or something instead?
Many users deactivate their referer, mostly not by choice.
But because they're behind a firewall that's blocking it.
Using protect from forgery is the only solution to protect you against CSRF.
But you can deactivate for any action you wish.
In your controller, you add :
skip_before_filter :verify_authenticity_token, :only => :create
This will deactive the token verification for the create action in the controller where you've added the filter.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With