excluding authorization check for action in controller

protect_from_forgery(options = {})

Turn on request forgery protection. Bear in mind that only non-GET, HTML/JavaScript requests are checked.


class FooController < ApplicationController
  protect_from_forgery :except => :index

You can disable csrf protection on controller-by-controller basis:

skip_before_filter :verify_authenticity_token

It can also be disabled for specific controller actions:

skip_before_filter :verify_authenticity_token, :except => [:create]

Valid Options:

  • :Only/:except – Passed to the before_filter call. Set which actions are verified.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s