I would second the use of fragment caching if there are bits of the form that are particularly complex to work out, otherwise, I wouldn't (and currently don't) bother.<br><br><div class="gmail_quote">On Thu, Jul 23, 2009 at 12:10 PM, Tom Lea <span dir="ltr"><<a href="mailto:lrug@tomlea.co.uk">lrug@tomlea.co.uk</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div style="word-wrap: break-word;"><div>You probably need a to_sym in there.... but I left that as an exercise for the reader.</div>
<div><div></div><div class="h5"><div><br></div><div><div>On 23 Jul 2009, at 12:06, Tom Lea wrote:</div><br><blockquote type="cite"><div style="word-wrap: break-word;"><div>How about this in your session controller (assuming restful).</div>
<div><br></div>def protect_against_forgery?<div> super unless [:new, :create].include? params[:action]</div><div>end</div><div><br></div><div>(you don't need the skip_filter with this solution either)</div><div><br>
</div>
<div>all untested. Good luck to ya!</div><div><br></div><div><div><div>On 23 Jul 2009, at 11:54, Taryn East wrote:</div><br><blockquote type="cite"><br><div class="gmail_quote">2009/7/23 Murray Steele <span dir="ltr"><<a href="mailto:murray.steele@gmail.com" target="_blank">murray.steele@gmail.com</a>></span><br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> <br><br><div class="gmail_quote"><div>2009/7/23 Taryn East <span dir="ltr"><<a href="mailto:teast@globalpersonals.co.uk" target="_blank">teast@globalpersonals.co.uk</a>></span><br>
</div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> Hi all,<div><br><br>Is there no way to render a form without the authenticity token? No other ideas?<br>
</div></blockquote><div><br>The bit that controls when an auth token are rendered is protect_against_forgery? a helper method which relies on the class level allow_forgery_protection variable. So on a controller level you could probably do this:<br>
<br>class IDontCareAboutNoForgeryController < ApplicationController<br> self.allow_forgery_protection = false<br>end<br><br>However, I can imagine that you might want the controller to care about forgery protection if auth tokens are provided, but in certain actions not actually bother with rendering an auth token. I don't think you can selectively include helpers in actions, so you might have to do some before_filter helper fu (or just use a separate controller for rendering the un-auth-token-generating-forms).</div>
</div></blockquote><div><br>I thought so too... but from looking into the source code "allow forgery protection" is just another way of calling the <b>verify_authenticity_token</b> filter (you can see it here:<a href="http://apidock.com/rails/ActionController/RequestForgeryProtection/ClassMethods/protect_from_forgery" target="_blank">http://apidock.com/rails/ActionController/RequestForgeryProtection/ClassMethods/protect_from_forgery</a>) .<br>
<br>It doesn't actually stop the token from being rendered into the form for that action (I checked).<br><br>I'm now simply curious about whether or not there is actually a way to not render the authenticity token... regardless of the actual application of said token. Is there a way of telling rails "don't render the token in this form/action" and having it actually obey... short of hacking into core?<br>
<br><br></div></div>Cheers,<br>Taryn<br> _______________________________________________<br>Chat mailing list<br><a href="mailto:Chat@lists.lrug.org" target="_blank">Chat@lists.lrug.org</a><br><a href="http://lists.lrug.org/listinfo.cgi/chat-lrug.org" target="_blank">http://lists.lrug.org/listinfo.cgi/chat-lrug.org</a><br>
</blockquote></div><br></div></div>_______________________________________________<br>Chat mailing list<br><a href="mailto:Chat@lists.lrug.org" target="_blank">Chat@lists.lrug.org</a><br><a href="http://lists.lrug.org/listinfo.cgi/chat-lrug.org" target="_blank">http://lists.lrug.org/listinfo.cgi/chat-lrug.org</a><br>
</blockquote></div><br></div></div></div><br>_______________________________________________<br>
Chat mailing list<br>
<a href="mailto:Chat@lists.lrug.org">Chat@lists.lrug.org</a><br>
<a href="http://lists.lrug.org/listinfo.cgi/chat-lrug.org" target="_blank">http://lists.lrug.org/listinfo.cgi/chat-lrug.org</a><br>
<br></blockquote></div><br>