Do Ruby on Rails 3 Jquery AJAX POST requests need the authenticity_token?

Question

According to the Rails security guide, if you use protect_from_forgery, all non-GET requests include an authenticity token. When I have Jquery AJAX POST requests, however, I don't see the authenticity_token param as one of the params in the request. Is this how it's supposed to work?

Also, it seems that POST requests from outside a session (curl in a script) don't require an authencity_token, either.

Thanks!

Answer 1

Rails will send this parameter in the headers rather than in the post data. You need to include the built in rails UJS library to get this to work. Take a look at the headers in your request and you should see one called X-CSRF-Token.