Allow API JSON requests to sidestep csrf protection

2025-12-02 15:34:20 +01:00
parent 0ce3a85778
commit efbd2cc3da
1 changed files with 1 additions and 1 deletions
@@ -12,7 +12,7 @@ module RequestForgeryProtection
    end

    def verified_request?
-      super || safe_fetch_site?
+      super || safe_fetch_site? || request.format.json?
    end

    SAFE_FETCH_SITES = %w[ same-origin same-site ]