rails-api/rails-api — pull request #153 by dgsan (2014-08-28 17:38:16+00:00)
Title: Adding info on removing protect_from_forgery to readme.

The implications of removing `protect_from_forgery` aren't made clear, which might be a big deal for the average user who likely relies on Rails to know best when it comes to things like authentication.

I can imagine there being a bunch of sites using rails-api with cookie-based auth and CSRF turned off. If using cookie-based auth is a requirement, there are workarounds for to inject CSRF headers into AJAX requests.

It's not really a simple issue, so I tried adding a question to the readme that would make the potential user investigate. It's also possible that it might make more sense to just link to information about token-based authentication in Rails, which I'd assume is what's typically used with APIs.