Whenever Rails receives a POST request, it performs some security checks to make sure the request is "valid." Verifications are performed by parsing the CSRF authentication tokens that MUST be presented with the form in the POST request.
If you cannot edit the form that makes the request in your rails application, you can skip the validation on the controller according to the principle:
class Foo < ApplicationController skip_before_filter :verify_authenticity_token
or you can also do this for a specific method in the controller:
class Foo < ApplicationController skip_before_filter :verify_authenticity_token, :only => [:create]
You can read about it here.
Zain zafar
source share