Unfloyded/Legamunt
0
0
Fork 0
Code Activity

Spec response for forgery (#3248)

Browse source 
Remove protect_from_forgery in ApiController, which is disabled by the
following skip_before_action, as well.
This commit is contained in:
Akihiko Odaki (@fn_aki@pawoo.net) 2017-06-02 03:56:55 +09:00 • committed by Eugen Rochko
parent e98559c3ff
commit 10768aa204
3 changed files with 28 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

10
spec/controllers/application_controller_spec.rb
View file

@ -37,6 +37,16 @@ describe ApplicationController, type: :controller do
end
end
context 'forgery' do
subject do
ActionController::Base.allow_forgery_protection = true
routes.draw { post 'success' => 'anonymous#success' }
post 'success'
end
include_examples 'respond_with_error', 422
end
it "does not force ssl if LOCAL_HTTPS is not 'true'" do
routes.draw { get 'success' => 'anonymous#success' }
ClimateControl.modify LOCAL_HTTPS: '' do