josh/rails-behaviors — pull request #22 by AndrewRadev (2012-08-24 13:45:09+00:00)
Title: Add CSRF token to non-GET links

When using rails' method overrides for links (`link_to '...', '...', :method => 'post'`), the CSRF token is not sent, even if the `rails/csrf` behaviour is included. This is pretty important, especially since (I just discovered) that rails resets the session for POST requests with no CSRF protection.

This pull request simply adds the same CSRF copying code to `rails/method`. This doesn't look like the best way to do it, since there's nothing conditional there -- it's included regardless of the presence of `rails/csrf`. Mind you, I'm not sure if that's a problem. I assume that if you wanted to ignore the CSRF protection, you simply wouldn't output the meta tags, so the additional code wouldn't really do anything. Still, feel free to completely ignore the attached code if you figure out a better solution.