Accept POST data from external source?

Ok, this is harder than I thought. I've got a hunk of XML coming in
from an entirely external source that I do not control (but another
department in my company does, so it's not like a giant security hole).
I was hoping to just have them POST their data to me, and then I'd read
the raw stream and parse it.

I'm sure folks know what I ran into -- Invalid Authenticity Token. If I
understand my googling right, I'm getting this because Rails did not
generate the "form" that posted the incoming data (even though there
wasn't one), so it doesn't come with an authentication key.

Anybody got suggestions on how to get around this? Do I have to work
with the folks generating the XML to do some sort of handshake that gets
them an authenticity token? But then, how would they send it over?
Surely there are other occasions when you might want some non-Rails
source to post a raw data stream to a Rails app?

Hi Duane,

Duane Morin skrev:

Ok, this is harder than I thought. I've got a hunk of XML coming in
from an entirely external source that I do not control (but another
department in my company does, so it's not like a giant security hole).
I was hoping to just have them POST their data to me, and then I'd read
the raw stream and parse it.

I'm sure folks know what I ran into -- Invalid Authenticity Token. If I
understand my googling right, I'm getting this because Rails did not
generate the "form" that posted the incoming data (even though there
wasn't one), so it doesn't come with an authentication key.

Anybody got suggestions on how to get around this? Do I have to work
with the folks generating the XML to do some sort of handshake that gets
them an authenticity token? But then, how would they send it over?
Surely there are other occasions when you might want some non-Rails
source to post a raw data stream to a Rails app?

Say for example that you want the create action of PeopleController to
accept requests from an external source, then you'ld simply add this
line to people_controller.rb:

protect_from_forgery :except => :create

See the documentation for the protect_from_forgery method:
http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html#M000493

Perfect - the data I need ends up in request.env['RAW_POST_DATA'].

Thanks!

D
David Knorr wrote: