attack prevented by Rack::Protection::RemoteToken

[oilpastels]

I have a sinatra app that works fine on Heroku, but when requested as
a page tab on facebook returns blank, and the logs read "attack
prevented by Rack::Protection::RemoteToken". What is this about?

[Evgeni Dzhelyov]

https://github.com/rkh/rack-protection/blob/master/lib/rack/protection/remote_token.rb

[mateo]

Facebook requests pages via POST, and since the referrer is different,
it's tripping up your app's CSRF protection

[oilpastels]

The problem is exactly what mateo described. I spoke with Konstantin
Haase, the maintainer of the rack-protection gem referenced by Evgeni
above, and he instructed me to:

> set :protection, :except => [:remote_token, :frame_options]

And it worked.

[vzmind]

I confirm that solve such issue. Just add

set :protection, :except => [:remote_token, :frame_options]

to your config.ru

----Tks