使用ionic作为前端+ Devise-rails作为后端时的CSRF身份验证问题？

Question

Is there any successful implementation that use Ionic mobile app to access remote Devise + rails Api server? Currently, the backend rails server works well, and I have added "rack-cors" to set white list for the remote access. On the front side, I use angular-devise to communicate with rails Api. But it shows the error below.

Can't verify CSRF token authenticity
Completed 422 Unprocessable Entity in 11ms

Most implementations use manually read token from csrf tag from rails or use 'angular_rails_csrf' gem. But all these above implementations rely on rails. Is there any possible client-side implementation that only use angular, ie ionic app?

Answer 1

Have you changed :exception to :null_session ?

class ApplicationController < ActionController::Base
  # Prevent CSRF attacks by raising an exception.
  # For APIs, you may want to use :null_session instead.
  protect_from_forgery with: :null_session

And also this information may be relevant to you.

jwako/devise_token_auth_demo