From 537d2939b10df9121e5a9f13a9d66c568ff681bf Mon Sep 17 00:00:00 2001
From: Patrick Figel <patrick@figel.email>
Date: Mon, 15 Jan 2018 06:51:23 +0100
Subject: Suppress CSRF token warnings (#6240)

CSRF token checking was enabled for API controllers in #6223,
producing "Can't verify CSRF token authenticity" log spam. This
disables logging of failed CSRF checks.

This also changes the protection strategy for
PushSubscriptionsController to use exceptions, making it consistent
with other controllers that use sessions.
---
 config/initializers/suppress_csrf_warnings.rb | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 config/initializers/suppress_csrf_warnings.rb

(limited to 'config')

diff --git a/config/initializers/suppress_csrf_warnings.rb b/config/initializers/suppress_csrf_warnings.rb
new file mode 100644
index 000000000..410ab585b
--- /dev/null
+++ b/config/initializers/suppress_csrf_warnings.rb
@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+ActionController::Base.log_warning_on_csrf_failure = false
-- 
cgit