Search code examples
ruby-on-railsruby-on-rails-5

How do turn off printing the authenticity token (CSRF) in Rails 5.2?

This question is not asking how to disable checking the authenticity token in the Rails app (that could be done using skip_forgery_protection inside the controller), but is asking how to avoid printing these HTML tags:

<meta name="csrf-param" content="authenticity_token" />
<meta name="csrf-token" content="cpm9jpvGk5RYBjI4RSQXL4M9x/tRCGFNQyboLAOMQg44e3UCydZzhjeyJ5eJEXhswWLoC8zd1Ure0Us07AjC9w==" />
Solution

  • These two tags are added by the <%= csrf_meta_tags %> method in your view layout. If you remove this method call, the tags won't be added to your HTML head anymore.

    However, depending on how you use JavaScript in your frontend, CSRF validation might break in this case as you may need the meta tags in order for JavaScript libraries to send a CSRF token with their requests.

    See https://guides.rubyonrails.org/security.html#csrf-countermeasures for details.