How to get around the_from_forgery protection in Rails 3 for a Facebook canvas application?

Question

I have a Rails 3 Facebook canvas app. When it loads, it gives me an invalid authentication token error and displays the signed_request parameter that Facebook sends to my application. Is there a way around the "protect_from_forgery" for signed_request from facebook?

Thanks!

Tim

Answer 1

The problem is resolved. I added

skip_before_filter :verify_authenticity_token, :only => [THE ACTION]

at the top of my controller.

Answer 2

You can also just remove protect_from_forgery from the application controller if you only use the application as a canvas application.