Rails / Doorkeeper: Can't verify CSRF token authenticity

Question

I'm using Rails 3.2 with Doorkeeper gem for providing OAuth 2 API for 3rd party. I keep getting this warning when using my REST API from outside of the app:

WARNING: Can't verify CSRF token authenticity

The client app successfully authenticated via OAuth2. Why do I get this warning, and how to implement this csrf properly for the external API?

Answer 1

Remove protect_from_forgery from your ApplicationController (or remove it for calls to the API).

Answer 2

Turn off CSRF protection only for the controller that you want open ... this is safer than removing protect_from_forgery from the ApplicationController. In this case I'm using the create action as an example ... though you can modify to suit your needs.

class MessagesController < ApplicationController
  protect_from_forgery with: :null_session, only: [:create]
  # doorkeeper_for :create
end

Uncomment the doorkeeper line if you are authentication via doorkeeper.

The point is to open up only what needs to be opened up ...