Rails protect_from_forgery with Mobile Apps
I am building an app on Rails and I have the `protect_from_forgery` in my `application.rb`.  I have also built a RESTful API for mobile apps to communicate with using `JSON` data.  I see some sites that claim that in order for the mobile app to interact with the rails application, they turn off `protect_from_forgery` for JSON requests.  

> How does this solve the problem of CSRF?  Can a malicious site not have JSON POST request that performs undesirable changes on behalf of the user?

So, to solve this problem , I decided to use a custom `mime-type` or perhaps a `special key` that only the mobile app would use, and then have `protect_from_forgery` perform the following:

 1. Check if the csrf token is present as a `hidden div` (true for the web app and included by default).
 2. If not present, check for this `special key` or `mime-type`.

Is there anyway to achieve this, or similar, to counter this problem?


Rails protect_from_forgery with Mobile Apps
===

I am building an app on Rails and I have the `protect_from_forgery` in my `application.rb`.  I have also built a RESTful API for mobile apps to communicate with using `JSON` data.  I see some sites that claim that in order for the mobile app to interact with the rails application, they turn off `protect_from_forgery` for JSON requests.  

> How does this solve the problem of CSRF?  Can a malicious site not have JSON POST request that performs undesirable changes on behalf of the user?

So, to solve this problem , I decided to use a custom `mime-type` or perhaps a `special key` that only the mobile app would use, and then have `protect_from_forgery` perform the following:

 1. Check if the csrf token is present as a `hidden div` (true for the web app and included by default).
 2. If not present, check for this `special key` or `mime-type`.

Is there anyway to achieve this, or similar, to counter this problem?

