# Protect\_from\_forgery :only =\> \[:create, :delete, :update\] what does this do exactly? **URL:** \ **Category:** Rails\ **Created:** [August 27, 2008, 4:12pm UTC](https://www.ruby-forum.com/t/protect-from-forgery-only-create-delete-update-what-does-this-do-exactly/147015 "2008-08-27T16:12:36Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![tyliong](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/e9a140/32.png) [@tyliong](https://www.ruby-forum.com/u/tyliong)\ **Post date:** [August 27, 2008, 4:12pm UTC](https://www.ruby-forum.com/t/protect-from-forgery-only-create-delete-update-what-does-this-do-exactly/147015/1 "2008-08-27T16:12:36Z")
protect\_from\_forgery :only =\> [:create, :delete, :update] Questions: (1)why do i need to put it in when i get an authenticate token error from passing an :id from the controller through AJAX? (2)are there any disadvantages in doing this(does this expose security loopholes)? (3)If it is that good should i use it in every controller? from ruby api( i still don’t understand what this means): Protecting controller actions from CSRF attacks by ensuring that all forms are coming from the current web application, not a forged link from another site, is done by embedding a token based on the session (which an attacker wouldn‘t know) in all forms and Ajax requests generated by Rails and then verifying the authenticity of that token in the controller. Only HTML/JavaScript requests are checked, so this will not protect your XML API (presumably you‘ll have a different authentication scheme there anyway). Also, GET requests are not protected as these should be indempotent anyway. ---
**Author:** ![tyliong](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/e9a140/32.png) [@tyliong](https://www.ruby-forum.com/u/tyliong)\ **Post date:** [August 27, 2008, 4:18pm UTC](https://www.ruby-forum.com/t/protect-from-forgery-only-create-delete-update-what-does-this-do-exactly/147015/2 "2008-08-27T16:18:31Z")
(3)If it is that good should i use it in every controller?. Somebody must thinkk so because it is the default in every app built. ---
**Author:** ![tyliong](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/e9a140/32.png) [@tyliong](https://www.ruby-forum.com/u/tyliong)\ **Post date:** [August 28, 2008, 3:46pm UTC](https://www.ruby-forum.com/t/protect-from-forgery-only-create-delete-update-what-does-this-do-exactly/147015/3 "2008-08-28T15:46:39Z")
It’s the default in any rails 2.0 project. ---
**Author:** ![tyliong](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/e9a140/32.png) [@tyliong](https://www.ruby-forum.com/u/tyliong)\ **Post date:** [August 28, 2008, 5:46pm UTC](https://www.ruby-forum.com/t/protect-from-forgery-only-create-delete-update-what-does-this-do-exactly/147015/4 "2008-08-28T17:46:55Z")
How come I have to add it in my controller to get rid of token error? ---
**Author:** ![tyliong](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/e9a140/32.png) [@tyliong](https://www.ruby-forum.com/u/tyliong)\ **Post date:** [August 27, 2008, 4:55pm UTC](https://www.ruby-forum.com/t/protect-from-forgery-only-create-delete-update-what-does-this-do-exactly/147015/5 "2008-08-27T16:55:25Z")
In production mode it’s a default? Sorry still haven’t got my app out of development mode so I have no idea what happens during production. ---
**Author:** ![tyliong](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/e9a140/32.png) [@tyliong](https://www.ruby-forum.com/u/tyliong)\ **Post date:** [August 28, 2008, 11:02pm UTC](https://www.ruby-forum.com/t/protect-from-forgery-only-create-delete-update-what-does-this-do-exactly/147015/6 "2008-08-28T23:02:24Z")
The protect\_from\_forgery is on by default to prevent Cross Site Request Forgery attacks. You don’t normally have to add this to your controller. What you are actually doing in this case is adding the call so that your ajax method is NOT protected from attacks. It might make more sense to use the following: protect\_from\_forgery :except =\> :your\_ajax\_method The end result should be the same. And listing which methods should not have protection is probably a more robust solution, since forgetting to add to the :except list will generate the kind of error you are seeing. Forgetting to add methods to the :only list will not generate any error messages. If you do not want to exclude your ajax method, your ajax submission needs to include the token. This is done automatically by the framework for most forms. ---
**Author:** ![tyliong](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/e9a140/32.png) [@tyliong](https://www.ruby-forum.com/u/tyliong)\ **Post date:** [October 7, 2008, 1:21pm UTC](https://www.ruby-forum.com/t/protect-from-forgery-only-create-delete-update-what-does-this-do-exactly/147015/7 "2008-10-07T13:21:37Z")
how do i find what ajax method is being used?. could you possibly give an example?