rails/rails — pull request #9405 by lucisferre (2013-02-24 22:56:46+00:00)
Title: Update CSRF docs to better explain API usage scenarios

- CSRF protection does not only apply to HTML/JS requests anymore (as
far as I can tell)
- CSRF protection is still fine to use with API requests and Rails
supports this scenario through the X-CSRF-Token header. Updated the
docs to reflect and explain this.

I was going through the API docs for this while configuring Rails to
work with AngularJS and noticed that they suggest Rails ignores CSRF
tokens on non HTML/JS requests. This does not appear to be the case
anymore.

Also while I understand the reasons why CSRF is not really an issue for
API requests, it does technically rely on secure implementations of the
browsers (and possibly their plugins) to ensure that a site can't make
XSS requests via AJAX. Since Rails easily supports submitting the CSRF
token via a header I thought it might be worth adding that API
developers can do that if they prefer.