Rails Ruby on Rails

Current forgery protection is not raise any exceptions as said in documentation. It just quietly reset session. And request processing goes to controller action.

# CSRF protection is turned on with the protect_from_forgery method, # which will check the token and raise an ActionController::InvalidAuthenticityToken # if it doesn't match what was expected. A call to this method is generated for new # \Rails applications by default. You can customize the error message by editing # public/422.html.

  def verify_authenticity_token
    verified_request? || handle_unverified_request
  end

  def handle_unverified_request
    reset_session
  end