title: security safe to disable csrf tokens for json rails calls?
body: <p>I have an existing rails backend website which makes json calls to server. Now,I am developing a mobile iOS app to use the same backend and send calls in json. However, mobile requests are failing with:</p>
  
  <pre><code>WARNING: Can't verify CSRF token authenticity
  </code></pre>
  
  <p>Searching around stackoverflow, many suggested to disable csrf checks for json calls by using something like this:</p>
  
  <pre><code># Or this in your application_controller.rb
  def verified_request?
    if request.content_type == "application/json"
      true
    else
      super()
    end
  end
  </code></pre>
  
  <p>But my question is , I dont understand how does this prevent csrf attacks in json format? Attacker can always send a json request to our endpoint from their site. Anyone has insights into this? I couldn't find any clear answer to this.</p>