How do I ignore the authenticity token for specific actions in Rails?

Question

When I have a specific action that I don\'t want to check the authenticity token on, how do I tell Rails to skip checking it?

Answer 1

In Rails4 you use skip_before_action with except or only.

class UsersController < ApplicationController
  skip_before_action :verify_authenticity_token, only: [:create]
  skip_before_action :some_custom_action, except: [:new]

  def new
    # code
  end

  def create
    # code
  end

  protected
  def some_custom_action
    # code
  end
end

Answer 2

In Rails 4:

skip_before_action :verify_authenticity_token, except: [:create, :update, :destroy]

And Rails 3:

skip_before_filter :verify_authenticity_token

---

For previous versions:

For individual actions, you can do:

protect_from_forgery :only => [:update, :destroy, :create]
#or
protect_from_forgery :except => [:update, :destroy, :create]

For an entire controller, you can do:

skip_before_action :verify_authenticity_token