Working with a RESTful API in Rails can be a bit challenging at times. One such problem is the ActionController::InvalidAuthenticityToken error. This error is thrown when authenticity token is not present or invalid. (This is how Rails protects itself from CSRF.) This token should only be checked with HTML and AJAX requests. XML requests do not need this check. However, if the following code is run:
$ curl -d "<status>...</status>" -X POST http://localhost:3000/statuses.xml
the InvalidAuthenticityToken error is raised. The problem stems from an incorrect content type. If you force the content type in the header:
$ curl -H "Content-Type: application/xml" -d "<status>...</status>" -X POST http://localhost:3000/statuses.xml
everything works as expected. This turns out to be a gotcha since GET requests don’t need the header.
