token auth but no cookies

[rzil]

Sorry in advance if this is a dumb question. I'm new and learning Rails. I want to add an POST api to a web app. Normally Rails checks for an authenticity token and returns ActionController::InvalidAuthenticityToken otherwise. This check needs to be skipped for api calls since it only applies to forms that come from the web app. This in turn raises a security issue, since the api could be vulnerable to a CSRF (Cross Site Request Forgery) attack. It seems to me, however, that if you require token authentication and avoid cookie authentication then this attack is not possible. So the question is, how do I use this framework to authenticate using a token but not a cookie, for a given controller.

[rzil]

Answered me own question; the controller should inherit from ActionController::API instead of ApplicationController

[gonzalo-bulnes]

Yes, this is correct @rzil!