actionpack/lib/action_controller/metal/request_forgery_protection.rb
# The actual before_action that is used to verify the CSRF token.
# Don't override this directly. Provide your own forgery protection
# strategy instead. If you override, you'll disable same-origin
# <tt><script></tt> verification.
#
# Lean on the protect_from_forgery declaration to mark which actions are
# due for same-origin request verification. If protect_from_forgery is
# enabled on an action, this before_action flags its after_action to
# verify that JavaScript responses are for XHR requests, ensuring they
# follow the browser's same-origin policy.
The actual before_action that is used to verify the CSRF token.
Don't override this directly. Provide your own forgery protection
strategy instead. If you override, you'll disable same-origin


Lean on the protect_from_forgery declaration to mark which actions are
due for same-origin request verification. If protect_from_forgery is
enabled on an action, this before_action flags its after_action to
verify that JavaScript responses are for XHR requests, ensuring they
follow the browser's same-origin policy.
The actual before_action that is used to verify the CSRF token . Don ' t override this directly . Provide your own forgery protection strategy instead . If you override you ' ll disable same - origin Lean on the protect_from_forgery declaration to mark which actions are due for same - origin request verification . If protect_from_forgery is enabled on an action this before_action flags its after_action to verify that JavaScript responses are for XHR requests ensuring they follow the browser ' s same - origin policy .
def verify_authenticity_token 
        mark_for_same_origin_verification!
        if !verified_request?
          logger.warn unverified_request_warning_message if logger && log_warning_on_csrf_failure
          handle_unverified_request
        end
      end
def verify_authenticity_token mark_for_same_origin_verification! if ! verified_request? logger . warn unverified_request_warning_message if logger && log_warning_on_csrf_failure handle_unverified_request end end
The actual before_action that is used to verify the CSRF token.
The actual before_action that is used to verify the CSRF token .
# :doc: