I'm trying to make an iOS app communicate with a Ruby on Rails website using JSON. While trying to post a login to create a user session, I discovered I was missing a CSRF token. I had no idea what that is at all, so I started looking into it, and found some solutions that say to remove the CSRF protection if the call format is 'application/json'. But that sounds like that leaves the website vulnerable?
Some results came up about JS forms having the same issue. The answers there were to add in the CSRF token. Which upon inspection, also appears to be in meta content tag in page headers.
So this leaves me in confusion, here's my questions:
- How does the token help protect anything if it can be read in prior call to the attacking call? Can a malicious site not simply make a request, parse the received message, and send another request with the token?
- Would it be safe to disable the token-check on the login post action, and have it send back the token along with the success response? If not, any better suggestions?