application_controller.rb

class ApplicationController < ActionController::Base
  # Prevent CSRF attacks by raising an exception.
  # For APIs, you may want to use :null_session instead.
  protect_from_forgery with: :exception
end

def protect_from_forgery(options = {})
   self.forgery_protection_strategy = protection_method_class(options[:with] || :null_session)
   self.request_forgery_protection_token ||= :authenticity_token
   prepend_before_action :verify_authenticity_token, options
 end

def verify_authenticity_token
  unless verified_request?
    logger.warn "Can't verify CSRF token authenticity" if logger
    handle_unverified_request
  end
end

def handle_unverified_request
  forgery_protection_strategy.new(self).handle_unverified_request
end