title: rails - "WARNING: Can't verify CSRF token authenticity" for json devise requests
body: <p>How can I retrieve the CSRF token to pass with a JSON request?</p>
  
  <p>I know that for security reasons <a href="http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails" rel="noreferrer">Rails is checking the CSRF token</a> on all the request types (including JSON/XML).</p>
  
  <p>I could put in my controller <code>skip_before_filter :verify_authenticity_token</code>, but I would lose the CRSF protection (not advisable :-) ).</p>
  
  <p>This similar (still not accepted) <a href="https://stackoverflow.com/questions/9044141/rails-devise-creating-new-users-via-json-request">answer</a> suggests to</p>
  
  <blockquote>
    <p>Retrieve the token with <code>&lt;%= form_authenticity_token %&gt;</code></p>
  </blockquote>
  
  <p>The question is how? Do I need to do a first call to any of my pages to retrieve the token and then do my real authentication with Devise? Or it is an information one-off that I can get from my server and then use consistently (until I manually change it on the server itself)?</p>