2012-03-30 78 views
0

我有一個Rails應用程序,包含文章和用戶。 所以我希望用戶可以從客戶端應用程序用json對象註銷並獲取所有文章也用json對象。發送JSON到Rails REST API

但是,我有一些問題。控制檯輸出:

Started POST "/articles" for 127.0.0.1 at 2012-03-30 17:29:25 +0200 
Processing by ArticlesController#create as JSON 
    Parameters: {"id"=>1, "article"=>{"id"=>1}} 
WARNING: Can't verify CSRF token authenticity 
Completed 401 Unauthorized in 1ms 

而這裏的Controler:

class ArticlesController < ApplicationController 
    before_filter :authenticate_user!, :except => [:show, :index] 

    # GET /articles 
    # GET /articles.json 
    def index 
    @articles = Article.all 

    respond_to do |format| 
     format.html # index.html.erb 
     format.json { render json: @articles } 
    end 
    end 

    # GET /articles/1 
    # GET /articles/1.json 
    def show 
    @article = Article.find(params[:id]) 

    respond_to do |format| 
     format.html # show.html.erb 
     format.json { render json: @article } 
    end 
    end 

    # GET /articles/new 
    # GET /articles/new.json 
    def new 
    @article = Article.new 

    respond_to do |format| 
     format.html # new.html.erb 
     format.json { render json: @article } 
    end 
    end 

    # GET /articles/1/edit 
    def edit 
    @article = Article.find(params[:id]) 
    end 

    # POST /articles 
    # POST /articles.json 
    def create 
    @article = Article.new(params[:article]) 

    respond_to do |format| 
     if @article.save 
     format.html { redirect_to @article, notice: 'Article was successfully created.' } 
     format.json { render json: @article, status: :created, location: @article } 
     else 
     format.html { render action: "new" } 
     format.json { render json: @article.errors, status: :unprocessable_entity } 
     end 
    end 
    end 

    # PUT /articles/1 
    # PUT /articles/1.json 
    def update 
    @article = Article.find(params[:id]) 

    respond_to do |format| 
     if @article.update_attributes(params[:article]) 
     format.html { redirect_to @article, notice: 'Article was successfully updated.' } 
     format.json { head :no_content } 
     else 
     format.html { render action: "edit" } 
     format.json { render json: @article.errors, status: :unprocessable_entity } 
     end 
    end 
    end 

    # DELETE /articles/1 
    # DELETE /articles/1.json 
    def destroy 
    @article = Article.find(params[:id]) 
    @article.destroy 

    respond_to do |format| 
     format.html { redirect_to articles_url } 
     format.json { head :no_content } 
    end 
    end 
end 

和模型:

class Article < ActiveRecord::Base 

end 

我送看起來像這樣JSON:

{ 
    "id" : 1 
} 

路線

    articles GET  /articles(.:format)      articles#index 
         POST  /articles(.:format)      articles#create 
      new_article GET  /articles/new(.:format)     articles#new 
      edit_article GET  /articles/:id/edit(.:format)    articles#edit 
       article GET  /articles/:id(.:format)     articles#show 
         PUT  /articles/:id(.:format)     articles#update 
         DELETE  /articles/:id(.:format)     articles#destroy 
        root   /          articles#index 

現在我的問題是:我的JSON對象是否錯誤,或者我錯過了什麼,比如CSRF令牌?

回答

1

您需要確保CSRF令牌隨每個JSON HTTP請求一起提交。這就是我的做法:

$.ajaxSetup({ 
    beforeSend: function(xhr) { 
    xhr.setRequestHeader('X-CSRF-Token', $('meta[name="csrf-token"]').attr('content')); 
    } 
});