Received: by 10.224.176.193 with SMTP id bf1mr13264280qab.3.1337611389449;
        Mon, 21 May 2012 07:43:09 -0700 (PDT)
X-BeenThere: rubyonrails-talk@googlegroups.com
Received: by 10.229.106.205 with SMTP id y13ls3670915qco.1.gmail; Mon, 21 May
 2012 07:42:06 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.224.70.212 with SMTP id e20mr1846447qaj.3.1337611326934; Mon,
 21 May 2012 07:42:06 -0700 (PDT)
Authentication-Results: ls.google.com; spf=pass (google.com: domain of
 jim...@gmail.com designates internal as permitted sender)
 smtp.mail=jim...@gmail.com; dkim=pass
 header...@gmail.com
Received: by j25g2000yqn.googlegroups.com with HTTP; Mon, 21 May 2012 07:42:06
 -0700 (PDT)
Date: Mon, 21 May 2012 07:42:06 -0700 (PDT)
In-Reply-To: <340afc46-f15f-4b7d-8b92-79adb970ed1f@googlegroups.com>
References: <340afc46-f15f-4b7d-8b92-79adb970ed1f@googlegroups.com>
User-Agent: G2/1.0
X-HTTP-UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4)
 AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2,gzip(gfe)
Message-ID: <6f7d22e8-db20-4cb3-86a9-4c6bb97b3486@j25g2000yqn.googlegroups.com>
Subject: Re: CSRF tokens for mobile apps
From: Jim <jim...@gmail.com>
To: "Ruby on Rails: Talk" <rubyonrails-talk@googlegroups.com>
Content-Type: text/plain; charset=ISO-8859-1

> I have an existing rails backend website which makes json ajax calls to my
> server and I was passing csrf tokens in every ajax call. Now,I am
> developing a mobile iOS app to use the same backend and send calls in json.
> However, mobile requests are failing with "Can't verify CSRF token
> authenticity", because i dont know of anyway to send the csrf token to
> rails from app.

This isn't so much a rails question as an iOS programming question.
In addition, a little very simple googling shows everything you need
to know to be able to do this (simple enough that it's obvious you
didn't even try).

Check out

http://stackoverflow.com/questions/3047563/rails-3-authenticity-token

to see how the token is sent to a browser.  You can probably just use:

<%= form_authenticity_token %>

to set the value of the token in your initial response to the iOS
app.  A quick test shows that AJAX requests to the server include the
token as a custom header in the request.

To learn how to set a custom http header in your iOS app, see:

http://stackoverflow.com/questions/1532206/changing-the-useragent-of-nsurlconnection

Jim