title: Rails: How to implement protect_from_forgery in Rails API mode
body: <p>I have a Rails 5 API app (<code>ApplicationController &lt; ActionController::API</code>). The need came up to add a simple GUI form for one endpoint of this API.</p>
  <p>Initially, I was getting <code>ActionView::Template::Error undefined method protect_against_forgery?</code> when I tried to render the form. I added <code>include ActionController::RequestForgeryProtection</code> and <code>protect_from_forgery with:exception </code> to that endpoint. Which solved that issue as expected.</p>
  <p>However, when I try to submit this form I get: <code>422</code> <code>Unprocessable Entity</code> <code>ActionController::InvalidAuthenticityToken</code>. I've added <code>&lt;%= csrf_meta_tags %&gt;</code> and verified that <code>meta: csrf-param</code> and <code>meta: csrf-token</code> are present in my headers, and that <code>authenticity_token</code> is present in my form. (The tokens themselves are different from each other.)</p>
  <p>I've tried, <code>protect_from_forgery prepend: true, with:exception</code>, no effect. I can &quot;fix&quot; this issue by commenting out: <code>protect_from_forgery with:exception</code>. But my understanding is that that is turning off CSRF protection on my form. (I want CSRF protection.)</p>
  <p>What am I missing?</p>
  <p><strong>UPDATE:</strong></p>
  <p>To try to make this clear, 99% of this app is a pure JSON RESTful API. The need came up to add one HTML view and form to this app. So <em>for one Controller</em> I want to enable full CSRF protection. The rest of the app doesn't need CSRF and can remain unchanged.</p>
  <p><strong>UPDATE 2:</strong></p>
  <p>I just compared the page source of this app's HTML form and Header with another conventional Rails 5 app I wrote. The <code>authenticity_token</code> in the Header and the <code>authenticity_token</code> in the form are <em>the same</em>. In the API app I'm having the problem with, they're <em>different</em>. Maybe that's something?</p>
  <p><strong>UPDATE 3:</strong></p>
  <p>Ok, I don't the the mismatch is the issue. However, in further comparisons between the working and non-working apps I noticed that there's nothing in Network &gt; Cookies. I see a bunch of things like <code>_my_app-session</code> in the cookies of the working app.</p>