跳过JSON POST API的用户和csrf身份验证

Question

Is there a way to skip require_user for JSON APIs.

I have a web application that sends JSON POST requests to my rails app and expects a JSON response. However, each request is being redirected to the login page as (I assume) it is not being registered as having a session.

So far this is what I have:

memo_main_tester_controller.rb

class MemoMainTesterController < ApplicationController

  before_action :require_user, unless: :json_request?
  ...

This is where API methods are

application_controller.rb

class ApplicationController < ActionController::Base

  protect_from_forgery
  skip_before_action :verify_authenticity_token, if: :json_request?

  helper_method :current_user
  ...

  def json_request?
    request.format.symbol == :json
  end

  private
  def current_user
    User.where(id: session[:user_id]).first
  end

  def require_user
    the_user = current_user
    unless the_user
      redirect_to login_path, notice: 'You must be logged in to view that page.'
    end
  end

I got the method json_request? from a search through SO, but I don't think it's working.

When I send a POST request to the memo_main_tester_controller the AJAX request hits a 302 and I am sent the login page with a 200 . How do I stop this and get my expected JSON response?

Answer 1

You app should be working on this stage. json_request? looks fine too. Thought there is a more generic way to rewrite it :

def json_request?
  request.format.json?
end

I think issue should be your request URL you call from your AJAX call is not ending with .json .