protect_from_forgery.rb

class ApplicationController < ActionController::Base
  protect_from_forgery
end

def protect_from_forgery(options = {})
   self.request_forgery_protection_token ||= :authenticity_token
   prepend_before_action :verify_authenticity_token, options
 end

def verify_authenticity_token
  unless verified_request?
    logger.warn "Can't verify CSRF token authenticity" if logger
    handle_unverified_request
  end
end

def handle_unverified_request
  reset_session
end