TEST_CODEOWNERS/rails
3
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Add note regarding CSRF for APIs, as a use-case for skipping it [ci skip]

Browse Source
This commit is contained in:
Zachary Scott 2015-04-12 21:58:40 -07:00
parent e1ebf146b5
commit 2778ba8ed5
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
actionpack/lib/action_controller/metal/request_forgery_protection.rb
View File

@ -42,6 +42,10 @@ class InvalidCrossOriginRequest < ActionControllerError #:nodoc:
# By default <tt>protect_from_forgery</tt> protects your session with
# <tt>:null_session</tt> method, which provides an empty session during request
#
# We may want to disable CSRF protection for APIs since they are typically
# designed to be state-less. That is, the requestion API client will handle
# the session for you instead of Rails.
#
# The token parameter is named <tt>authenticity_token</tt> by default. The name and
# value of this token must be added to every layout that renders forms by including
# <tt>csrf_meta_tags</tt> in the HTML +head+.