# Accept POST data from external source? **URL:** \ **Category:** Rails\ **Created:** [March 31, 2009, 4:48am UTC](https://www.ruby-forum.com/t/accept-post-data-from-external-source/164309 "2009-03-31T04:48:21Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![dmorin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/f0a364/32.png) [@dmorin](https://www.ruby-forum.com/u/dmorin)\ **Post date:** [March 31, 2009, 4:48am UTC](https://www.ruby-forum.com/t/accept-post-data-from-external-source/164309/1 "2009-03-31T04:48:21Z")
Ok, this is harder than I thought. I’ve got a hunk of XML coming in from an entirely external source that I do not control (but another department in my company does, so it’s not like a giant security hole). I was hoping to just have them POST their data to me, and then I’d read the raw stream and parse it. I’m sure folks know what I ran into – Invalid Authenticity Token. If I understand my googling right, I’m getting this because Rails did not generate the “form” that posted the incoming data (even though there wasn’t one), so it doesn’t come with an authentication key. Anybody got suggestions on how to get around this? Do I have to work with the folks generating the XML to do some sort of handshake that gets them an authenticity token? But then, how would they send it over? Surely there are other occasions when you might want some non-Rails source to post a raw data stream to a Rails app? ---
**Author:** ![dmorin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/f0a364/32.png) [@dmorin](https://www.ruby-forum.com/u/dmorin)\ **Post date:** [March 31, 2009, 6:17am UTC](https://www.ruby-forum.com/t/accept-post-data-from-external-source/164309/2 "2009-03-31T06:17:02Z")
Hi Duane, On Tue, 2009-03-31 at 04:48 +0200, Duane M. wrote: > Ok, this is harder than I thought. I’ve got a hunk of XML coming in > from an entirely external source > From Rails’ perspective, that external source is just another client. > Looks like you’re requiring your app’s other clients to be logged in. > You’ll need to either have this one log in too, or exempt it by giving > it its own ‘channel’. HTH, Bill ---
**Author:** ![dmorin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/f0a364/32.png) [@dmorin](https://www.ruby-forum.com/u/dmorin)\ **Post date:** [March 31, 2009, 7:54am UTC](https://www.ruby-forum.com/t/accept-post-data-from-external-source/164309/3 "2009-03-31T07:54:21Z")
Duane M. skrev: > Anybody got suggestions on how to get around this? Do I have to work > with the folks generating the XML to do some sort of handshake that gets > them an authenticity token? But then, how would they send it over? > Surely there are other occasions when you might want some non-Rails > source to post a raw data stream to a Rails app? Say for example that you want the create action of PeopleController to accept requests from an external source, then you’ld simply add this line to people\_controller.rb: protect\_from\_forgery :except =\> :create See the documentation for the protect\_from\_forgery method: [http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html#M000493](http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html#M000493) – Best regards, David K. [http://twitter.com/rubyguy](http://twitter.com/rubyguy) ---
**Author:** ![dmorin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/f0a364/32.png) [@dmorin](https://www.ruby-forum.com/u/dmorin)\ **Post date:** [March 31, 2009, 4:20pm UTC](https://www.ruby-forum.com/t/accept-post-data-from-external-source/164309/4 "2009-03-31T16:20:15Z")
Perfect - the data I need ends up in request.env[‘RAW\_POST\_DATA’]. Thanks! D David K. wrote: > Duane M. skrev: > > > Anybody got suggestions on how to get around this? Do I have to work > > with the folks generating the XML to do some sort of handshake that gets > > them an authenticity token? But then, how would they send it over? > > Surely there are other occasions when you might want some non-Rails > > source to post a raw data stream to a Rails app? > > Say for example that you want the create action of PeopleController to > accept requests from an external source, then you’ld simply add this > line to people\_controller.rb: > > protect\_from\_forgery :except =\> :create > > See the documentation for the protect\_from\_forgery method: > [ActionController::RequestForgeryProtection::ClassMethods](http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html#M000493) > > – > Best regards, > David K. > [http://twitter.com/rubyguy](http://twitter.com/rubyguy)