title: Using rails with security in mind
body: <p>I am currently developing a prototype for a chatbot.  Using devise and can-can I create a simple chat box that through the use of Jquery and Ajax send jsons requests to and from the website.  Since I did not use any of the rails helpers in my current build anyone can send a json object to this url (Lets call it mysite.com/message) and receive a response from the chatbot in Json. </p>
  
  <p>I need help in getting rid of this vulnerability so that anyone regardless of whether or not they are logged in can send things to /message.  If there was a rails helper that generates something analagous to authenticity tokens that would be sufficient.  I've developed a few sites in rails but am still learning how to develop in the "Rails" way.</p>
  
  <p>Edit: </p>
  
  <p>The problem is that I do not want any logged in user to for example send a json object to /message when it is meant to be used only for the chatbox.  If I browse to the url then I can see the json response in my browser.</p>