Databases
StackOverflow2013
Postsdbo
POMy jquery AJAX POST requests works without sending an Authenticity Token (Rails)
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POMy jquery AJAX POST requests works without sending an Authenticity Token (Rails)
    primarykey
    data
    text
    <p>Is there any provisions in rails that would allow all AJAX POST requests from the site to pass without an authenticity_token?</p> <p>I have a Jquery POST ajax call that calls a controller method, but I did not put any authenticity code in it and yet the call succeeds.</p> <p>My ApplicationController does have 'request_forgery_protection' and I've changed</p> <pre><code>config.action_controller.consider_all_requests_local </code></pre> <p>to false in my environments/development.rb</p> <p>I've also searched my code to ensure that I was not overloading ajaxSend to send out authenticity tokens.</p> <p>Is there some mechanism in play that disables the check? Now I'm not sure if my CSRF protection is working or not.</p> <p>I'm using Rails 2.3.5.</p> <p><strong>Update for clarity:</strong></p> <pre><code>function voteup(url, groupid){ $.ajax({ type: "POST", url: "/groups/" + groupid + "/submissions/voteup", data: "url=" + url, dataType: 'text', success: function(data){ var counter = "vote_" + url; $('#vote_' + url.cleanify()).text(" " + data + " "); } }); }; </code></pre> <p>I have a link which then has a 'href that calls the above function:</p> <pre><code>&lt;a href='javascript:voteup(param1,param2)'&gt;...&lt;/a&gt; </code></pre>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USDavid C
    1. USDavid C
    plurals
    1. PL
      singulars
      1. LTLinked
    2. PL
      singulars
      1. LTLinked
    1. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POMy jquery AJAX POST requests works without sending an Authenticity Token (Rails)
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POMy jquery AJAX POST requests works without sending an Authenticity Token (Rails)
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. POMy jquery AJAX POST requests works without sending an Authenticity Token (Rails)
      1. This table or related slice is empty.
      1. VTUpMod
    1. COI remembered answering a similar question.. found it here: http://stackoverflow.com/questions/2725118/rails-request-forgery-protection-settings/2725991#2725991 I guess it should be because its a local request. It should not work say from an app running on a different port or a different domain. Ex: If you have your app running on localhost:3000 you should not be able to do a ajax POST from localhost:3001.
      singulars
      1. POMy jquery AJAX POST requests works without sending an Authenticity Token (Rails)
      1. USShripad Krishna
    2. COHi Shripad, I saw your post, but how is this happening? Is there some kind of Rails magic involved? Looking online, I still see people writing about instructions to send form_authenticity_token, so if its fixed, why is there still a need to do that?
      singulars
      1. POMy jquery AJAX POST requests works without sending an Authenticity Token (Rails)
      1. USDavid C
    3. COThis has nothing to do with Rails magic whatsoever. Ajax works without a authenticity token if it is invoked within the domain itself. You need a authenticity token not for enabling ajax to work on your domain but to prevent attacks from other domains. That is the primary reason for having `protect_from_forgery` in your application controller. The best example of an attack from another domain is the "Myspace sammy worm". Look it up. You'll then understand as to why you need a auth token.
      singulars
      1. POMy jquery AJAX POST requests works without sending an Authenticity Token (Rails)
      1. USShripad Krishna
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload