After upgrading to Rails 5.2 I started to get an ActionController::InvalidAuthenticityToken error for all forms in my application. I have worked around this by disabling Turbolinks for all forms, which works but is not a very good solution.
Seaarching the internet, the common solution recommended seems to be to disable protect_from_forgery
skip_before_action :verify_authenticity_token, raise: false
- https://github.com/ForestAdmin/forest-rails/pull/254
- Rails 5.2 some controller actions gives InvalidAuthenticityToken
- https://github.com/nsarno/knock/issues/208
- https://github.com/rails/rails/commit/ec4a836919c021c0a5cf9ebeebb4db5e02104a55
Why would we need to disable protect_from_forgery, and doesn't that create a security hole ?
EDIT
csrf_meta_tags
are in the layout.