diff --git a/app/views/layouts/turbo_rails/frame.html.erb b/app/views/layouts/turbo_rails/frame.html.erb index 0171671e..4241534d 100644 --- a/app/views/layouts/turbo_rails/frame.html.erb +++ b/app/views/layouts/turbo_rails/frame.html.erb @@ -1,5 +1,6 @@ + <%= csrf_meta_tags %> <%= yield :head %> diff --git a/test/dummy/app/controllers/application_controller.rb b/test/dummy/app/controllers/application_controller.rb index 09705d12..e8065d95 100644 --- a/test/dummy/app/controllers/application_controller.rb +++ b/test/dummy/app/controllers/application_controller.rb @@ -1,2 +1,3 @@ class ApplicationController < ActionController::Base + protect_from_forgery end diff --git a/test/dummy/config/environments/test.rb b/test/dummy/config/environments/test.rb index a482563f..af13e885 100644 --- a/test/dummy/config/environments/test.rb +++ b/test/dummy/config/environments/test.rb @@ -28,7 +28,7 @@ config.action_dispatch.show_exceptions = :none # Disable request forgery protection in test environment. - config.action_controller.allow_forgery_protection = false + config.action_controller.allow_forgery_protection = true # Print deprecation notices to the stderr. config.active_support.deprecation = :stderr diff --git a/test/frames/frame_request_controller_test.rb b/test/frames/frame_request_controller_test.rb index 41b1c512..72805297 100644 --- a/test/frames/frame_request_controller_test.rb +++ b/test/frames/frame_request_controller_test.rb @@ -14,6 +14,8 @@ class Turbo::FrameRequestControllerTest < ActionDispatch::IntegrationTest assert_select "head", count: 1 assert_select "meta[name=test][content=present]" + assert_select "meta[name=csrf-param]" + assert_select "meta[name=csrf-token]" end test "frame request layout can be overridden" do