Rails shows “WARNING: Unable to authenticate CSRF token” from POST RestKit

Question

When I try to POST from RestKit , a warning appears in the Rails console:

 Started POST "/friends" for 127.0.0.1 at 2012-04-16 09:58:10 +0800 Processing by FriendsController#create as */* Parameters: {"friend"=>{"myself_id"=>"m001", "friend_id"=>"f001"}} WARNING: Can't verify CSRF token authenticity (0.1ms) BEGIN SQL (1.7ms) INSERT INTO `friends` (`friend_id`, `myself_id`) VALUES ('f001', 'm001') (1.1ms) COMMIT Redirected to http://127.0.0.1:3000/friends/8 Completed 302 Found in 6ms (ActiveRecord: 3.0ms) 

Here is the client code:

 NSMutableDictionary *attributes = [[NSMutableDictionary alloc] init]; [attributes setObject: @"f001" forKey: @"friend_id"]; [attributes setObject: @"m001" forKey: @"myself_id"]; NSMutableDictionary *params = [NSMutableDictionary dictionaryWithObject:attributes forKey:@"friend"]; [[RKClient sharedClient] post:@"/friends" params:params delegate:self]; 

How can I get rid of the warning?

Answer 1

You can safely remove warnings with the following:

 skip_before_filter :verify_authenticity_token 

This should be included in every Rails API controller that you have, or if you have a base_controller for all API controllers, then put it there.

If you can also access your application through a web browser, do not put this line in application_controller , as you will create a security vulnerability.

It is safe to remove csrf for API calls, since a specific vulnerability can only be accessed through a web browser.

December 16, 2013 Patch

I saw some links to this answer and other content that offers clarification. The API may be vulnerable to CSRF if you use Internet authentication methods to authenticate APIs, such as sessions or cookies.

There are a few good details. Is your web API susceptible to a CSRF exploit? .

My advice still applies to RestKit users, as user credentials are unlikely to be based on sessions or cookies, but rather on usernames or api.

If your API can be authenticated using session or cookies, you should avoid skipping : verify_authenticity_token , and you should consider switching to api-based authentication.

If your API can be authenticated with a username and password, which is also used for authentication on the Internet, there is still a potential exploit, although it is less serious, as it will require the user to enter the username and password for your site in the Auth HTTP field when visiting a site using an exploit. Again, for better security, you should consider switching to api-based authentication.

It is worth noting that I do not agree that you need to add :only => [:your_method] for additional protection, provided that you have isolated api controllers, your api does not mix with your web responses, and you do not Use session or cookies. If they are in place, you can safely add skip_before_filter to base_controller for your api.