Rails 5.2 some controller actions gives InvalidAuthenticityToken

Question

Previously I used a gem which provided a controller for accepting external services to POST some data into our app. However in Rails 5.2 it stopped working. When the endpoint is triggered, it raises ActionController::InvalidAuthenticityToken error.

Answer 1

For Rails before 5.2, the generated ApplicationController will call protect_from_forgery, meaning POST,PUT,DELETE actions are checked for authenticity.

New Rails 5.2 projects will by default check authenticity token for any subclass of ActionController::Base instead, which affects many existing Gems.

You can wait for the gem updates for compatibility with 5.2.

Alternatively, you can probably monkey patch these controllers in the initializer:

require 'foo_controller'
class FooController < ActionController::Base
  skip_before_action :verify_authenticity_token, raise: false
end