authenticity_token appears in URLs after AJAX GET request

+1 ... had some code already close to doing this. did a before and after with applying this change and it is confirmed to remove the unnecessary token

The only annoyance was git didn't like applying the patch because of a lack of a valid email address

Not sure what you mean but if you need my address, it's chewi@aura-online.co.uk.

$ git am < ~/Desktop/authenticity-token-ajax-get.diff

Patch does not have a valid e-mail address.

I'm still very new to git and while I understand the concept, it still confuses the hell out of me. However, from what I can see "am" is for merging patches from a mailbox. You should use "apply" instead.

I was going to add some but I think forgery protection is disabled during tests anyway?

Chewi, have a look at request_forgery_protection_test.rb file. That should give you a rough idea.

Thanks.

Ah I was looking at prototype_helper_test.rb. The thing is there is currently no test to check whether remote_function DOES add the token for non-GET requests either. I guess I should write one for that too?