Instantly share code, notes, and snippets.
Don't bork your JSON API:
class Api::BaseController < ApplicationController
@javan Confused why you would need to skip the before filter in API. Wouldn't request.xhr? be true?
@tundal45 Not really. I can access an API through any place, not just the browser.
@tundal45 request.xhr? is only true for most ajax requests. If your API is for consumption over HTTP, you'll need to skip that check.
Worth noting is that this would go hand-in-hand with all GET .js requests getting the xhr header added. So this would protect on all verbs, including GET.
@javan what about actions working like this
They don't have specified params[:format]. I've seen it in the wild