[Rails] API 相關處理

Gem

gem ‘rack-cors’, ‘~>1.0.2’, require: ‘rack/cors’ gem ‘grape-swagger-rails’, ‘~> 0.3.0’ gem ‘swagger-docs’, ‘~> 0.2.9’

CSRF 相關

只允許某個 controller 跳過 CSRF

skip_before_filter :verify_authenticity_token

只允許某個 action 跳過 CSRF

skip_before_filter :verify_authenticity_token, only: [:index]

只允許 .json 跳過 CSRF

skip_before_filter :verify_authenticity_token, if: :json_request?

或

protect_from_forgery unless: -> { request.format.json? }