title: How to turn off rails protect_from_forgery filter only for json
body: <p>I have web site built with Rails3 and now I want to implement json API for mobile client access. However, sending json post request from the client because of the protect_from_forgery filter.  Because the client will not retrieve any data from the server, there is no way that the client can receive auth_token so I would like to turn off the protect_from_forgery option only for json requests (I thought rails3 does this in default but apparently it does not).</p>
  
  <p>I know similar topic is discussed at <a href="https://stackoverflow.com/questions/1245618/rails-invalidauthenticitytoken-for-json-xml-requests">here</a> but in that case, he receives auth_token before sending post request.</p>
  
  <p>So my question is turning off the protect_from_forgery only for json is good way of doing this? If yes, how to do so? If no, what is the alternative?</p>
  
  <p>FYI, I use following ajax request  </p>
  
  <pre><code>$.ajax({
               type: 'POST',  
               url: "http://www.example.com/login.json",  
               data: { 'email': emailVal, 'password': passwordVal },  
               success: onSuccess,  
               error: onError,  
               dataType: "json"  
  });
  </code></pre>
  
  <p>and I get ActionController::InvalidAuthenticityToken error.</p>
  
  <p>By the way, following curl command works though...</p>
  
  <pre><code>curl -H "Content-Type: application/json" -c cookies.txt -d '{"email": emailVal, "password": passwordVal}' -X POST http://www.example.com/login.json -i
  </code></pre>