Turning off InvalidAuthenticityToken for a RESTful Service

Rails
1

Hi,

I was trying to write a RESTful service and was planning on testing
via tools such as cURL and the basic http libs. With the
InvalidAuthenticityToken piece that is turned by default in Rails
2.0.2, I have to provide the token with each request. This is
something of a pain for a programmable client that may not make a GET
request before performing other actions, specifically POST, PUT and
DELETE.

Is there a way to turn it off and/or program a client utilizing the
cookie without making a GET request first?

Thanks!

Eric L.
http://ionrock.org/blog/

2

Hi All,

On Feb 1, 11:55 am, Eric L. [email protected] wrote:

Is there a way to turn it off and/or program a client utilizing the
cookie without making a GET request first?

Thanks!

Eric L.http://ionrock.org/blog/

Just answering my own post:

From
http://ryandaigle.com/articles/2007/9/24/what-s-new-in-edge-rails-better-cross-site-request-forging-prevention

Add this to controllers to override the default secure cookie check:

skip_before_filter :verify_authenticity_token

And to disable things completely, add this to application.rb:

self.allow_forgery_protection = false

Hope it helps someone else!

Eric L.
http://ionrock.org/blog/

3

On Feb 1, 2008 9:55 AM, Eric L. [email protected] wrote:

Is there a way to turn it off and/or program a client utilizing the
cookie without making a GET request first?

It shouldn’t be verifying requests unless they’re using the html or js
(ajax) formats. XML or JSON should be fine:

http://dev.rubyonrails.org/browser/tags/rel_2-0-2/actionpack/lib/action_controller/request_forgery_protection.rb#L82

–
Rick O.
http://lighthouseapp.com
http://weblog.techno-weenie.net
http://mephistoblog.com