A Rails controller disables CSRF protection with skip_before_action :verify_authenticity_token.

Why this matters

This turns off the authenticity-token check for the actions it covers, so a malicious page can drive a logged-in user's browser into submitting state-changing requests (CWE-352). LLM-generated controllers reach for this line to "fix" a 422 InvalidAuthenticityToken error instead of sending the token.

If the controller serves browser forms, keep CSRF on and send the token. If it is a genuine token-authenticated API or webhook endpoint (no cookie session), that is legitimate, but prove the request some other way: verify a signature/HMAC or a bearer token on every action, and scope this skip narrowly with only: rather than across the whole controller.

# frozen_string_literal: true

class ApiController < ApplicationController
  # ruleid: auth.ruby.session.skip-verify-authenticity-token
  skip_before_action :verify_authenticity_token

  # ruleid: auth.ruby.session.skip-verify-authenticity-token
  skip_before_action :verify_authenticity_token, only: [:create, :update]

  # ruleid: auth.ruby.session.skip-verify-authenticity-token
  skip_before_action :verify_authenticity_token, if: :json_request?

  def create
    head :created
  end
end

# frozen_string_literal: true

class ApplicationController < ActionController::Base
  # CSRF protection stays on for browser-facing controllers.
  protect_from_forgery with: :exception

  # Skipping a different callback is unrelated to CSRF.
  skip_before_action :require_login, only: [:index]
end

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.ruby.session.skip-verify-authenticity-token -- <reason>

References