class ApplicationController < ActionController::Base
  # Prevent CSRF attacks by raising an exception.
  # For APIs, you may want to use :null_session instead.
  protect_from_forgery with: :null_session
  before_action :authenticate_user!

  add_flash_types :danger, :error, :success, :warning
end

class ApplicationController < ActionController::Base
  # Prevent CSRF attacks by raising an exception.
  # For APIs, you may want to use :null_session instead.
  protect_from_forgery with: :exception
  before_action :authenticate_user!

  add_flash_types :danger, :error, :success, :warning
end

Switch from Null Session to Exception for CSRF Protection
Switch from Null Session to Exception for CSRF Protection

There are apparently some vulnerabilities to session 
nulling, depending on how one uses before_action. Not using before_action in vulnerable ways right now, but 
since I will undoubtedly forget this in the future I'm 
switching to exception.