title: Rails authorization necessary for post actions?
body: <p>I have an app I'm writing in rails 3 w/ cancan and devise.  I'm curious if authorizing post actions on your controllers is necessary or helpful from a security standpoint? Assuming all my controller actions require authentication w/ devise (ie user must be logged in).</p>
  
  <p>I can see why I need authorization through cancan on my controller actions that use GET's since a user can simply input the url they wish to visit freely and this must be locked down. However, with posts the user must post the data from a form, which is protected against an xss attack with a token.</p>
  
  <p>In this case would it be safe to assume that if i limit the visibility of, say, a button in my view with cancan that the user wouldn't be able to submit a form maliciously?</p>
  
  <p>Thanks alot </p>
  
  <p>EDIT:</p>
  
  <p>Thanks for the quick answer guys.  As it has been pointed out below a malicious user can forge a form post using tools such as firebug and thus authorization is necessary.</p>
  
  <p>What would be the best way to simulate this type of interaction (a user posting to an url with a form they've hacked) using capybara / cucumber? </p>
  
  <p>Thanks again.</p>