# Bypassing session integrity check

**URL:** <https://www.ruby-forum.com/t/bypassing-session-integrity-check/147318>\
**Category:** Rails\
**Created:** [August 31, 2008, 12:15am UTC](https://www.ruby-forum.com/t/bypassing-session-integrity-check/147318 "2008-08-31T00:15:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![markh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/7993a0/32.png) [@markh](https://www.ruby-forum.com/u/markh)\
**Post date:** [August 31, 2008, 12:15am UTC](https://www.ruby-forum.com/t/bypassing-session-integrity-check/147318/1 "2008-08-31T00:15:00Z")

</div>

I’ve a PDA application that posts data to a RoR web app. But I don’t  
include a ‘authenticity\_token’ field and the server is returning ‘The  
change you wanted was rejected’. Removing  
‘config.action\_controller.session’ from environment.rb doesn’t seem to  
work. Is there any way to tell RoR to ignore the session check for a set  
of controller actions?

Thanks,  
Mark

---

<div class="post-metadata">

**Author:** ![markh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/7993a0/32.png) [@markh](https://www.ruby-forum.com/u/markh)\
**Post date:** [August 31, 2008, 12:23am UTC](https://www.ruby-forum.com/t/bypassing-session-integrity-check/147318/2 "2008-08-31T00:23:07Z")

</div>

You can use the protect\_from\_forgery method,  
found the answer here:  
[http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html](http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html)