title: Rails 5.2 ActionController::InvalidAuthenticityToken
body: <p>After upgrading to Rails 5.2 I started to get an <strong>ActionController::InvalidAuthenticityToken</strong> error for all forms in my application. I have worked around this by disabling Turbolinks for all forms, which works but is not a very good solution.</p>
  
  <p>Seaarching the internet, the common solution recommended seems to be to disable <strong>protect_from_forgery</strong></p>
  
  <p><code>skip_before_action :verify_authenticity_token, raise: false</code></p>
  
  <ul>
  <li><a href="https://github.com/ForestAdmin/forest-rails/pull/254" rel="nofollow noreferrer">https://github.com/ForestAdmin/forest-rails/pull/254</a></li>
  <li><a href="https://stackoverflow.com/questions/48762136/rails-5-2-some-controller-actions-gives-invalidauthenticitytoken">Rails 5.2 some controller actions gives InvalidAuthenticityToken</a></li>
  <li><a href="https://github.com/nsarno/knock/issues/208" rel="nofollow noreferrer">https://github.com/nsarno/knock/issues/208</a></li>
  <li><a href="https://github.com/rails/rails/commit/ec4a836919c021c0a5cf9ebeebb4db5e02104a55" rel="nofollow noreferrer">https://github.com/rails/rails/commit/ec4a836919c021c0a5cf9ebeebb4db5e02104a55</a></li>
  </ul>
  
  <p>Why would we need to disable <strong>protect_from_forgery</strong>, and doesn't that create a security hole ?</p>
  
  <p><strong>EDIT</strong></p>
  
  <p><code>csrf_meta_tags</code> are in the layout.</p>
  
  <p><a href="https://i.stack.imgur.com/xRdW9.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/xRdW9.png" alt="enter image description here"></a></p>