From 79a829a0372a974bb3d40e66ca3fdc213200db40 Mon Sep 17 00:00:00 2001 From: Stan Hu Date: Tue, 23 Jan 2018 22:02:33 -0800 Subject: [PATCH] Return a blank JSON response for a missing .js file to prevent Rails CSRF errors The default 404 handler would return the Content-Type format based on the given format extension. This would cause the Rails CSRF protection to flag an error, since the .js extension gets mapped to text/javascript format. Closes #40771 --- app/controllers/application_controller.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index ee21d81f23e..95ad38d9230 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -147,6 +147,8 @@ class ApplicationController < ActionController::Base format.html do render file: Rails.root.join("public", "404"), layout: false, status: "404" end + # Prevent the Rails CSRF protector from thinking a missing .js file is a JavaScript file + format.js { render json: '', status: :not_found, content_type: 'application/json' } format.any { head :not_found } end end