23

When I try to POST from RestKit, there is a warning in Rails console:

Started POST "/friends" for 127.0.0.1 at 2012-04-16 09:58:10 +0800 Processing by FriendsController#create as */* Parameters: {"friend"=>{"myself_id"=>"m001", "friend_id"=>"f001"}} WARNING: Can't verify CSRF token authenticity (0.1ms) BEGIN SQL (1.7ms) INSERT INTO `friends` (`friend_id`, `myself_id`) VALUES ('f001', 'm001') (1.1ms) COMMIT Redirected to http://127.0.0.1:3000/friends/8 Completed 302 Found in 6ms (ActiveRecord: 3.0ms)

Here is client code:

NSMutableDictionary *attributes = [[NSMutableDictionary alloc] init]; [attributes setObject: @"f001" forKey: @"friend_id"]; [attributes setObject: @"m001" forKey: @"myself_id"]; NSMutableDictionary *params = [NSMutableDictionary dictionaryWithObject:attributes forKey:@"friend"]; [[RKClient sharedClient] post:@"/friends" params:params delegate:self];

How can I get rid of the warning?

Improve this question

1 Answer 1

Reset to default
72

You can safely remove the warnings with the following:

skip_before_filter :verify_authenticity_token

This should go into every Rails API controller that you have, or if you have a base_controller for all API controllers then put it there.

If you can also access your app through a web browser then do not put this line in the application_controller as you will be creating a security vulnerability.

It is safe to remove csrf for API calls as the particular vulnerability can only be executed through a web browser.

Update 16th December 2013

I've seen some links to this answer and some other content which suggests a clarification. An API may be vulnerable to CSRF if you use web based authentication methods to authenticate the API - e.g. sessions or cookies.

There is some good detail in Is your Web API susceptible to a CSRF exploit?.

My advice still stands for users of RestKit as user credentials are unlikely to be based on sessions or cookies but rather usernames or api keys.

If your API can be authenticated with session or cookies then you should avoid skipping : verify_authenticity_token and you should think about moving to api key based authentication.

If your API can be authenticated with a username and password that is also used to authenticate on the web there is still a potential exploit, although it is less serious as it would require the user to type in their username and password to your site in the HTTP Auth challenge box while visiting the site with the exploit. Again, for the best security you should think about moving to api key based authentication.

It's worth noting that I don't agree that you need to add :only => [:your_method] for additional protection, provided that you have isolated api controllers, your api is not mixed with your web responses and you are not using session or cookies. If these are in place you can safely add the skip_before_filter into a base_controller for your api.

Improve this answer
Sign up to request clarification or add additional context in comments.

3 Comments

To avoid opening a big hole, I recommend skiping the verification just for your method. skip_before_filter :verify_authenticity_token :only => [:your_method]
for those cut and pasting the above code: skip_before_filter :verify_authenticity_token, :only => [:your_method] Marc forgot a comma. DIdn't see an edit button.
This really helped understand this issue and how to solve it if you have a Rails API that uses tokens (alongside controllers that respond to regular web requests): github.com/lynndylanhurley/devise_token_auth/issues/343

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.