5
我得到这个警告设计+ Omniauth [警告:无法验证CSRF令牌真实性]
WARNING: Can't verify CSRF token authenticity
马上我的回调动作运行之前,即
Started GET "https://stackoverflow.com/users/auth/open_id?openid_url=https%3A%2F%2Fwww.google.com%2Faccounts%2Fo8%2Fid" for 98.xxx.xx.xx at 2011-09-12 16:26:02 -0400
Started GET "https://stackoverflow.com/users/auth/open_id/callback?openid_url=https%3A%2%2Fwww.google.com%2Faccounts ... etc ... etc
Processing by Users::OmniauthCallbacksController#open_id as HTML
Parameters: {"openid_url"=>"https://www.google.com/accounts/o8/id"}
WARNING: Can't verify CSRF token authenticity
Entering Users::OmniauthCallbacksController, omniauth_login
没有为请求没有警告直接来自浏览器。我正在使用rails 3.1,设计1.4.5,omniauth 0.2.6。
想法如何解决这个问题?
谢谢!
你能更具体吗?你在哪里/如何关闭它?只为openid身份验证?否则,它听起来像它可能会导致潜在的安全漏洞... – gingerlime
只有当你知道**你在做什么时,你才应该这样做。如果你打算根据StackOverflow答案关闭'protect_from_forgery',你**不知道你在做什么! –