CODEWITHSUNDEEP
ruby-on-railscsrfprotect-from-forgery
Sprachprofi
Sprachprofi

Reputation: 1259

CSRF issue on embedded form

I have a Wordpress site that embeds some elements of a Ruby on Rails site (which is our Members Area and is located on a subdomain). The elements include a login form. When people use it, Rails returns an error due to invalid CSRF token. Do I have to disable CSRF for the login action? What are my options? If the answer is to disable it, then is there a painless way to do so for Devise?

Upvotes: 0

Views: 229

Answers (1)

Cillian Collins
Cillian Collins

Reputation: 728

Do not disable the CSRF token for security purposes. Instead, look through the code and identify where the CSRF token is originating from, usually the DB, and then you can create a variable with that token value and echo it into an field within the form in question with the specific CSRF token parameter that PHP is expecting.

Upvotes: 0

Related Questions