API/JSON：无法验证CSRF令牌的真实性

Question

  def create
    organization = Organization.find(params[:organization][:node_id])
    node = organization.nodes.build(nodes_params.except[:id])
    if node.save
      render json: node, status: :ok
    else
      render json: node, status: :bad_request
    end
  end

protect_from_forgery
skip_before_action :verify_authenticity_token, if: :json_request?
private
  def json_request?
    request.format.json?
  end

Answer 1

按照对application_controller.rb的注释，您需要将这一行protect_from_forgery::null_session放在一起。

如果您只为从applicationcontroller继承的所有API控制器多创建一个根控制器会更好。即

class Api::ApiController < ApplicationController
  #TODO
  protect_from_forgery with: :null_session
end

其他API的控制器

class Api::V1::AddressesController < Api::ApiController
  #TODO
end