Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

5
  • getting error: "ActionController::InvalidCrossOriginRequest (Security warning: an embedded <script> tag on another site requested protected JavaScript. If you know what you're doing, go ahead and disable forgery protection on this action to permit cross-origin JavaScript embedding.)". So i disabled 'protect from forgery' and it works. Anyway can you please elaborate why it has to be this way? Commented Aug 6, 2014 at 4:59
  • Suppose there is a service which exports json data to lot many apps. Here, i cant modify the server code to consider the callback. The apps which are going to consume the json data need to handle it. how can that be done? Commented Aug 6, 2014 at 5:01
  • So this might be better as a separate question, perhaps even on securityexchange, but the docs are here: edgeapi.rubyonrails.org/classes/ActionController/… guides.rubyonrails.org/… (a good rails security guide)... Basically, implementing good csrf protections when you want to provide a JSONP endpoint is a little tricky and requires some careful thinking. Are the apps/consumers going to be on different domains than the REST server? A good start: stackoverflow.com/questions/613962/is-jsonp-safe-to-use Commented Aug 7, 2014 at 4:52
  • the apps/consumers are going to be different apps. My angular app theme is based on the official angularjs tutorial(phones catalogue) app. the only difference is that the tutorials use json files stored in the app to retrieve data whereas i am using a rails app to expose the data using APIs. Commented Aug 7, 2014 at 5:06
  • 1
    Honestly, if you're interested in having a secure app, I would use CORS (cross-origin-request-sharing) instead of JSONP. That way your REST server can actually choose specific domains to allow cross-domain requests from. Also - you can make use of angular's CSRF protections with tokens in the headers and you can check those tokens on your rails side. Commented Aug 7, 2014 at 10:03