clearance: Undefined method protect_from_forgery for Clearance::SessionsController:Class

Only now that I’m trying to push to Heroku am I seeing errors about protect_from_forgery being undefined, namely: /app/vendor/bundle/ruby/2.1.0/gems/clearance-1.3.0/app/controllers/clearance/sessions_controller.rb:3:in': undefined method protect_from_forgery' for Clearance::SessionsController:Class (NoMethodError)

I’ve tried overriding with both skip_before_filter :verify_authenticity_token and protect_from_forgery, with: :null_session by subclassing Clearance::SessionsController.

Now I’m out of ideas.

About this issue

Original URL
State: closed
Created 10 years ago
Reactions: 2
Comments: 17 (4 by maintainers)

Commits related to this issue

Add Serializer to project and create Call serializer Add serializer gem and generate serializer for call in serializer/api/v1 to match routes. Had to add protect_from_forgery to fix a bug with Action... — committed to walkingalchemy/dial-a-script-backend by walkingalchemy 6 years ago

Most upvoted comments

protect_from_forgery is a class method included in ActionController::RequestForgeryProtection If you want to keep ActionController::API then add just after class ApplicationController > ActionController::API: include ActionController::RequestForgeryProtection Also, this will allow you to set CSRF token with method form_authenticity_token.

Hope this helps!

+102

tehPlayer on Aug 28, 2018

def protect_from_forgery
end

+38

derekprior on Jun 11, 2014

To be honest, I’m not sure why Clearance has protect_from_forgery in SessionsController rather than relying on whatever the user has (or has not) setup in ApplicationController. I’m further puzzled as to why it’d be skipped in the SessionsController#create action. I’ll have to dig through git to see if there’s an explanation.

For the time being, you could keep ApplicationController::API and either:

Find the appropriate module in Rails that would give you the actual protect_from_forgery method and include that in your ApplicationController.
Define protect_from_forgery as a no-op on your ApplicationController.

derekprior on Jun 5, 2014

I was inheriting my ApplicationController from ActionController::API; changing to ActionController::Base fixes this issue, but is not ideal behavior.

Any thoughts?

joshsmith on Jun 1, 2014