protect_from_forgery is not quite class-wise

I've run unto this problem myself and I like Your solution.

+1

Maybe I should give an example here.

For two controllers, one has protect_from_forgery and not.

Class A < ApplicationController

protect_from_forgery

...

end

Class B < ApplicationController

session :off

...

end

If I did not use cookie session or declare controller B as session off, when I use link_to_remote in the views for B, I get a crash for no :secret is given in B.

By default allow_forgery_protection is true and request_forgery_protection_token is a cattr_accessor. So no matter where protect_from_forgery is called once, protect_against_forgery? will return true everywhere.

I think the controller should modify the router tree and mark paths as protected.

When the path for the xhr is marked as forgery protected it should request a token.

Just an idea though...

Since I'm not using action specific FP I only:

-- a/actionpack/lib/action_controller/base.rb

+++ b/actionpack/lib/action_controller/base.rb

@@ -340,7 +340,7 @@ module ActionController #:nodoc:

1. Sets the token parameter name for RequestForgery. Calling +protect_from_forgery+
2. sets it to :authenticity_token by default.

• cattr_accessor :request_forgery_protection_token
• class_inheritable_accessor :request_forgery_protection_token

1. Indicates whether or not optimise the generated named
2. route helper methods

Regards

Florian Aßmann

-1, tested this and it's not a problem on master