{"action":"closed","issue":{"url":"https://api.github.com/repos/ks222rt/1DV450_ks222rt/issues/6","repository_url":"https://api.github.com/repos/ks222rt/1DV450_ks222rt","labels_url":"https://api.github.com/repos/ks222rt/1DV450_ks222rt/issues/6/labels{/name}","comments_url":"https://api.github.com/repos/ks222rt/1DV450_ks222rt/issues/6/comments","events_url":"https://api.github.com/repos/ks222rt/1DV450_ks222rt/issues/6/events","html_url":"https://github.com/ks222rt/1DV450_ks222rt/issues/6","id":137289732,"number":6,"title":"Global protect_from_forgery with: :null_session","user":{"login":"rk222ev","id":8580645,"avatar_url":"https://avatars.githubusercontent.com/u/8580645?v=3","gravatar_id":"","url":"https://api.github.com/users/rk222ev","html_url":"https://github.com/rk222ev","followers_url":"https://api.github.com/users/rk222ev/followers","following_url":"https://api.github.com/users/rk222ev/following{/other_user}","gists_url":"https://api.github.com/users/rk222ev/gists{/gist_id}","starred_url":"https://api.github.com/users/rk222ev/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rk222ev/subscriptions","organizations_url":"https://api.github.com/users/rk222ev/orgs","repos_url":"https://api.github.com/users/rk222ev/repos","events_url":"https://api.github.com/users/rk222ev/events{/privacy}","received_events_url":"https://api.github.com/users/rk222ev/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-02-29T15:43:18Z","updated_at":"2016-03-02T18:36:04Z","closed_at":"2016-03-02T18:36:04Z","body":"Setting  protect_from_forgery with: :null_session in the ApplicationController will enforce this behaviour on the entire app. Apikey registration and admin features included.\r\n\r\nI don't know if this is the intended and expected behaviour. But an alternative solution would be to move the null_session to a BaseController that inherits from ApplicationController and then let the different api controllers inherit from BaseController. Keeping the option protect_from_forgery in controllers inheriting directly from ApplicationController.\r\n\r\nFor more info on the different options see:\r\nhttp://stackoverflow.com/a/31236249/4248654\r\n\r\nJust a thought."}}