Skipping CSRF protection isn't required

[Damu112]

I guess you should mention that CSRF protection can be enabled by a workaround. The average beginner might not be aware of the consequences of just deactivating this security feature.

stackoverflow has a pretty good workaround.

[davetron5000]

Yup. I'll see about updating the code to account for this. At the time I wasn't aware of how to deal with it.

[thomaskonrad]

In order to follow up on this: It's simply a matter of adding the following code to your application_controller.rb:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception

  after_filter :set_csrf_cookie_for_ng

  def set_csrf_cookie_for_ng
    cookies['XSRF-TOKEN'] = form_authenticity_token if protect_against_forgery?
  end

  protected
  def verified_request?
    super || valid_authenticity_token?(session, request.headers['X-XSRF-TOKEN'])
  end

The rest is automatically handled by Angular when it sees the XSRF-TOKEN cookie. See also the Stackoverflow question Damu112 already mentioned.