Prevent cross-origin js requests

application_controller.rb

class ApplicationController < ActionController::Base
  before_filter :ensure_xhr

  private
    def ensure_xhr
      if request.get? && request.format && (request.format.js? || request.format.json?)
        head :forbidden unless request.xhr?
      end
    end
end

@homakov If the incoming request doesn't have .js in the path or a javascript Accept header, request.format.js? will be false. If you've made the decision to still return js in that scenario then the above solution will not protect you.