application_controller.rb

class ApplicationController < ActionController::Base
  protect_from_forgery
  

protected

  def handle_unverified_request
    super
    raise ActionController::InvalidAuthenticityToken
  end

end

test_forgery_protection.rb

require 'spec_helper'

describe JobsController do
  
  it 'raises error with invalid authenticity token' do
    with_forgery_protection do
      expect { post :create }.to raise_error
    end
  end
  
  private
  
  def with_forgery_protection
    _old_value = @controller.allow_forgery_protection
    @controller.allow_forgery_protection = true
    yield
  ensure
    @controller.allow_forgery_protection = _old_value
  end
end