Question

I have a rails app that serves some APIs to an iPhone application.
I want to be able to simply post on a resource without minding on get the correct CSRF token.
I tried some methods that I see here in stackoverflow but it seems they no longer work on rails 3.

Thank you for helping me.

Answer 1

In the controller where you want to disable CSRF the check:

skip_before_action :verify_authenticity_token

Or to disable it for everything except a few methods:

skip_before_action :verify_authenticity_token, :except => [:update, :create]

Or to disable only specified methods:

skip_before_action :verify_authenticity_token, :only => [:custom_auth, :update]

More info: RoR Request Forgery Protection