# Protect from forgery for Rest destroy action?

**URL:** <https://www.ruby-forum.com/t/protect-from-forgery-for-rest-destroy-action/191843>\
**Category:** Rails\
**Created:** [July 19, 2010, 6:51pm UTC](https://www.ruby-forum.com/t/protect-from-forgery-for-rest-destroy-action/191843 "2010-07-19T18:51:36Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![chuckychuck](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/df705f/32.png) [@chuckychuck](https://www.ruby-forum.com/u/chuckychuck)\
**Post date:** [July 19, 2010, 6:51pm UTC](https://www.ruby-forum.com/t/protect-from-forgery-for-rest-destroy-action/191843/1 "2010-07-19T18:51:36Z")

</div>

Hi !!  
I’m reading the rails guides about security, i had a question about the  
forgery protection

If we consider a standard Restful resource ( generated with scaffold for  
example ), the update and create actions are protected from forgery  
attacks thanks to the authenticity token, but what about the destroy  
method ??

\<a href="/posts/2"  
data-method="delete"rel="nofollow"\>Supprimer\</a\>

A third party website could paste a link with the same href and other  
attributes and changing the link text et that would indeed destroy my  
post wouldn’it ?? There’s no token here …

Thanks