API 使用 versionist gem 跳过真实性验证答案

【问题标题】：API skips authenticity verification with versionist gemAPI 使用 versionist gem 跳过真实性验证
【发布时间】：2014-12-19 18:42:12
【问题描述】：

我正在尝试为我的 Rails 应用程序实现验证真实性，这似乎是 Rails 的一项功能

并且无法确定回调失败的位置......

这是我的应用控制器：

class ApplicationController < ActionController::Base
  protect_from_forgery
end

这是我的 API 控制器：

class V1::ManagerLeadsController < ApplicationController
  def create
    manager_lead = ManagerLead.create!(manager_lead_params)
    render json: manager_lead
  end

  private
  def manager_lead_params
    params.require(:manager_lead).permit(:first_name, :last_name, :email, :phone, :company,
       :format, :requested_date, :meeting_type, :has_complited_wholesale_investor_form
    )
  end
end

这是我的日志：

Started POST "/api/v1/manager_leads" for 127.0.0.1 at 2014-10-24 10:29:46 +1100
Processing by V1::ManagerLeadsController#create as JSON
  Parameters: {"manager_lead"=>{"first_name"=>"", "last_name"=>"", "email"=>"", "phone"=>"", "company"=>"", "meeting_type"=>""}}
Can't verify CSRF token authenticity
   (0.1ms)  BEGIN
  SQL (0.3ms)  INSERT INTO "manager_leads" ("company", "created_at", "email", "first_name", "last_name", "meeting_type", "phone", "updated_at") VALUES ($1, $2, $3, $4, $5, $6, $7, $8) RETURNING "id"  [["company", ""], ["created_at", "2014-10-23 23:29:46.833290"], ["email", ""], ["first_name", ""], ["last_name", ""], ["meeting_type", ""], ["phone", ""], ["updated_at", "2014-10-23 23:29:46.833290"]]
   (7.6ms)  COMMIT
Completed 200 OK in 23ms (Views: 0.4ms | ActiveRecord: 9.4ms)

无法验证 CSRF 令牌的真实性，但是请求以 200OK 响应完成:(

如果我这样做：

if verified_request?
  manager_lead = ManagerLead.create!(manager_lead_params)
  render json: manager_lead
else
  render json: { error: 'Unprocessed entity' }, status: 422
end

然后应用程序开始正常工作：

Started POST "/api/v1/manager_leads" for 127.0.0.1 at 2014-10-24 10:30:59 +1100
Processing by V1::ManagerLeadsController#create as JSON
  Parameters: {"manager_lead"=>{"first_name"=>"", "last_name"=>"", "email"=>"", "phone"=>"", "company"=>"", "meeting_type"=>""}}
Can't verify CSRF token authenticity
Completed 422 Unprocessable Entity in 3ms (Views: 0.1ms | ActiveRecord: 0.0ms)

我正在使用

Rails 4.1.5
versionist gem
jquery-ui-rails # for form submission

【问题讨论】：

标签： jquery ruby-on-rails ruby authentication csrf

【解决方案1】：

好的，答案是：

protect_from_forgery with: :exception

【讨论】：