From dca062147a4e579313e4d136ab45f023c1aa6bc1 Mon Sep 17 00:00:00 2001 From: vangberg Date: Tue, 16 Jun 2026 08:22:44 +0200 Subject: [PATCH] Use Rails 5.2 defaults The one necessary change was to remove `protect_from_forgery(with: :exception)` since this is now implicitly part of the controller callbacks. Verified with: ``` % bundle exec rails runner 'ApplicationController._process_action_callbacks.select { |cb| cb.kind == :before }.each_with_index { |cb, i| puts "#{i+1}: #{cb.filter.inspect}" }' 1: :verify_authenticity_token 2: :set_turbolinks_location_header_from_session 3: :check_api! 4: :store_user_location! ``` which still includes `verify_authenticity_token`. Part of #277. --- app/controllers/application_controller.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index ffd6a98d..cdb4a347 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -1,7 +1,6 @@ class ApplicationController < ActionController::Base include PageHelper - protect_from_forgery(with: :exception) before_action(:check_api!) before_action(:store_user_location!, if: :storable_location?)