For example, two controllers, one has protect_from_forgery and not.
Class A < ApplicationController
Class B < ApplicationController
If I do not use cookie session or declare controller B as session off,
when I use link_to_remote in the views for B, I get a crash for
no :secret is given in B.
Currently, protect_against_forgery? is implemented as
allow_forgery_protection && request_forgery_protection_token
By default allow_forgery_protection is true and
request_forgery_protection_token is a cattr_accessor. So no matter
where protect_from_forgery is called once, protect_against_forgery?
will return true everywhere, which makes protect_against_forgery? not
quite useful to tell whether a controller is protect against forgery
I have proposed a fix at
. Hope it help.