# Turning off InvalidAuthenticityToken for a RESTful Service

**URL:** <https://www.ruby-forum.com/t/turning-off-invalidauthenticitytoken-for-a-restful-service/127836>\
**Category:** Rails\
**Created:** [February 1, 2008, 6:55pm UTC](https://www.ruby-forum.com/t/turning-off-invalidauthenticitytoken-for-a-restful-service/127836 "2008-02-01T18:55:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![eric99](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/a88e4f/32.png) [@eric99](https://www.ruby-forum.com/u/eric99)\
**Post date:** [February 1, 2008, 6:55pm UTC](https://www.ruby-forum.com/t/turning-off-invalidauthenticitytoken-for-a-restful-service/127836/1 "2008-02-01T18:55:55Z")

</div>

Hi,

I was trying to write a RESTful service and was planning on testing  
via tools such as cURL and the basic http libs. With the  
InvalidAuthenticityToken piece that is turned by default in Rails  
2.0.2, I have to provide the token with each request. This is  
something of a pain for a programmable client that may not make a GET  
request before performing other actions, specifically POST, PUT and  
DELETE.

Is there a way to turn it off and/or program a client utilizing the  
cookie without making a GET request first?

Thanks!

* * *

Eric L.  
[http://ionrock.org/blog/](http://ionrock.org/blog/)

---

<div class="post-metadata">

**Author:** ![eric99](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/a88e4f/32.png) [@eric99](https://www.ruby-forum.com/u/eric99)\
**Post date:** [February 1, 2008, 7:09pm UTC](https://www.ruby-forum.com/t/turning-off-invalidauthenticitytoken-for-a-restful-service/127836/2 "2008-02-01T19:09:36Z")

</div>

Hi All,

On Feb 1, 11:55 am, Eric L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Is there a way to turn it off and/or program a client utilizing the  
> cookie without making a GET request first?
> 
> Thanks!
> 
> * * *
> 
> Eric L.[http://ionrock.org/blog/](http://ionrock.org/blog/)

Just answering my own post:

From  
[http://ryandaigle.com/articles/2007/9/24/what-s-new-in-edge-rails-better-cross-site-request-forging-prevention](http://ryandaigle.com/articles/2007/9/24/what-s-new-in-edge-rails-better-cross-site-request-forging-prevention)

Add this to controllers to override the default secure cookie check:

skip\_before\_filter :verify\_authenticity\_token

And to disable things completely, add this to application.rb:

self.allow\_forgery\_protection = false

Hope it helps someone else!

* * *

Eric L.  
[http://ionrock.org/blog/](http://ionrock.org/blog/)

---

<div class="post-metadata">

**Author:** ![eric99](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/a88e4f/32.png) [@eric99](https://www.ruby-forum.com/u/eric99)\
**Post date:** [February 1, 2008, 8:25pm UTC](https://www.ruby-forum.com/t/turning-off-invalidauthenticitytoken-for-a-restful-service/127836/3 "2008-02-01T20:25:49Z")

</div>

On Feb 1, 2008 9:55 AM, Eric L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Is there a way to turn it off and/or program a client utilizing the  
> cookie without making a GET request first?

It shouldn’t be verifying requests unless they’re using the html or js  
(ajax) formats. XML or JSON should be fine:

[http://dev.rubyonrails.org/browser/tags/rel\_2-0-2/actionpack/lib/action\_controller/request\_forgery\_protection.rb#L82](http://dev.rubyonrails.org/browser/tags/rel_2-0-2/actionpack/lib/action_controller/request_forgery_protection.rb#L82)

–  
Rick O.  
[http://lighthouseapp.com](http://lighthouseapp.com)  
[http://weblog.techno-weenie.net](http://weblog.techno-weenie.net)  
[http://mephistoblog.com](http://mephistoblog.com)