Question

I don’t use protect_from_forgery in my application controller, and on my development environment it works as expected, no session is generated. But on production environment the CSRF token is written to the session.

Session.inspect gives

{:_csrf_token => "duY6ATHEBzYXzg8aXdNF6CZYXicPhlFQdDodjREMwAM=",
 :session_id => "25728f624574a1d831b4510b2e7f6c92"}

Why does this happen?

Answer 1

I found that in one partial I have

<% form_tag session_path, :method => :post do -%>

and it writes _csrf_token to session.