{"action":"created","issue":{"url":"https://api.github.com/repos/ministryofjustice/prison-visits/issues/260","labels_url":"https://api.github.com/repos/ministryofjustice/prison-visits/issues/260/labels{/name}","comments_url":"https://api.github.com/repos/ministryofjustice/prison-visits/issues/260/comments","events_url":"https://api.github.com/repos/ministryofjustice/prison-visits/issues/260/events","html_url":"https://github.com/ministryofjustice/prison-visits/pull/260","id":102383175,"number":260,"title":"Fix CSRF protection at the ApplicationController","user":{"login":"EGiataganas","id":7561969,"avatar_url":"https://avatars.githubusercontent.com/u/7561969?v=3","gravatar_id":"","url":"https://api.github.com/users/EGiataganas","html_url":"https://github.com/EGiataganas","followers_url":"https://api.github.com/users/EGiataganas/followers","following_url":"https://api.github.com/users/EGiataganas/following{/other_user}","gists_url":"https://api.github.com/users/EGiataganas/gists{/gist_id}","starred_url":"https://api.github.com/users/EGiataganas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/EGiataganas/subscriptions","organizations_url":"https://api.github.com/users/EGiataganas/orgs","repos_url":"https://api.github.com/users/EGiataganas/repos","events_url":"https://api.github.com/users/EGiataganas/events{/privacy}","received_events_url":"https://api.github.com/users/EGiataganas/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-08-21T13:49:50Z","updated_at":"2015-08-26T13:11:17Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/ministryofjustice/prison-visits/pulls/260","html_url":"https://github.com/ministryofjustice/prison-visits/pull/260","diff_url":"https://github.com/ministryofjustice/prison-visits/pull/260.diff","patch_url":"https://github.com/ministryofjustice/prison-visits/pull/260.patch"},"body":"Fix the implementation of CSFR protection at thet Application Level by\r\nsetting `protect_from_forgery with: :exception` in the\r\n`ApplicationController`"},"comment":{"url":"https://api.github.com/repos/ministryofjustice/prison-visits/issues/comments/135008520","html_url":"https://github.com/ministryofjustice/prison-visits/pull/260#issuecomment-135008520","issue_url":"https://api.github.com/repos/ministryofjustice/prison-visits/issues/260","id":135008520,"user":{"login":"dan-palmer","id":1006365,"avatar_url":"https://avatars.githubusercontent.com/u/1006365?v=3","gravatar_id":"","url":"https://api.github.com/users/dan-palmer","html_url":"https://github.com/dan-palmer","followers_url":"https://api.github.com/users/dan-palmer/followers","following_url":"https://api.github.com/users/dan-palmer/following{/other_user}","gists_url":"https://api.github.com/users/dan-palmer/gists{/gist_id}","starred_url":"https://api.github.com/users/dan-palmer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dan-palmer/subscriptions","organizations_url":"https://api.github.com/users/dan-palmer/orgs","repos_url":"https://api.github.com/users/dan-palmer/repos","events_url":"https://api.github.com/users/dan-palmer/events{/privacy}","received_events_url":"https://api.github.com/users/dan-palmer/received_events","type":"User","site_admin":false},"created_at":"2015-08-26T13:11:17Z","updated_at":"2015-08-26T13:11:17Z","body":"This is fine but it would be nice if we could test it. \r\n\r\nIts kind of fiddly to test through a feature test but perhaps we could do something with the `forgery_protection_strategy` config value that `ActionController::Base` has. Calling this should return whatever the strategy is if it has been set in the controller or nil. Perhaps we could have a shared example that all the controller tests have that asserts forgery protection is enabled. Its quite implementation specific doing it this way but I can't think of an alternate thats cleaner off the top of my head.\r\n\r\nThoughts @SteveMarshall, @threedaymonk ?"}}