Rails 7 | ActionController::InvalidAuthenticityToken after Successfull Payment

Question

I have integrated a payment gateway via Easebuzz, so far so good,The success URL is a POST request to orders#successE (ControllerName#MethodName), after successfull payment, when it is calling successE POST request, i am getting:

this is the code:

def payE
                @payment_response = Easebuzz::Payment.initiate({
                  "txnid" => "#{@order.id}",
                  "amount" => amount.to_f,
                  "firstname" => current_user.name,
                  "email" => current_user.email,
                  "phone" => current_user.phone_number,
                  "surl" => "http://localhost:3000/orders/#{@order.id}/successE",
                  "furl" => "http://localhost:3000/response.php",
                  "address1" => address,
                  "country" => "India",
                  #"zipcode" => "123123"
                })
        
                if @payment_response['status'] == 1
                  data = @payment_response['data']
                  redirect_to("https://testpay.easebuzz.in/pay/#{data}", allow_other_host: true, status: 303)
                end
end

how can i fix this issue? :')

can someone explain what is happening in simple words? is it trying to verify CSRF Token but it cannot because a null is returned? please insert some new knowledge into my brain :- ) i would really appreciate it!

Answer 1

Ruby on Rails is unable to verify the authenticity token on this controller method, because the callback from the external application does support and doesn't send the expected token.

To disable the authenticity token only on this specific controller method, add this code to your controller:

skip_before_action :verify_authenticity_token, only: [:successE]

Read more about Rails' RequestForgeryProtection.