request_forgery_protection_token should be set at ActionController::Base load time

This is a small-tiny-patch but important one.

I have one controller, that logs-in users:

  class UsersController < ActionController::Base
    protect_from_forgery :only => :login

    def login
      ...
    end
  end

And I have another one, that shows my homepage:

  class ContentController < ActionController::Base
    def index
      ...
    end
  end

What happens is that my homepage has a form to login users quickly, but since request_forgery_protection_token is nil when my app loads, protect_against_forgery? returns false and the form doesn't have a authenticity_token field.

So, when the user fill the form, it will be sent to UsersController#login, that will call protect_from_forgery that will finally set request_forgery_protection_token.

But since no token was sent, it will raise a InvalidAutenticityToken error.

To fix this, we just have to set on ActionController::Base:

  @@request_forgery_protection_token = :authenticity_token

And while it's not released, I recommend to put the line above in your ApplicationController.