smunz

Shouldn't it also be your Job to inform your relatives? Just sayin'

Absolutely. Any suggestions for places to find more content like this?

Not to leave HN, just to complement it ;)

Interesting statement! What would you suggest as a replacment for long option lists? Autocomplete?

I think activerecord in rails 3 comestibles Odette close - except the modification of from.

It seems like your server(s) have gone down: I'm getting an '502 Bad Gateway' from nginx.

Would love to try it out!

Actually there is Labor mobility between the States of the EU.

I guess they forced the end of the session to allow non-session authentication, for example for an Client accessing an RESTful API.

I didn't found anything about this, but when you look at the related commit in rails (https://github.com/rails/rails/commit/66ce3843d32e9f2ac3b1da...) they also removed the white listing an all non html-requests ("content_mime_type.verify_request?"). So any (api) client modifying XML or JSON resources of an rails app would not be allowed to do so, because of the need to provide the authentication token. Which isn't available for an API client, because there is no session.

So instead of throwing an exception to prevent an CSRF-attack they just kill the session to prevent authentication by this session. For an api client this is no big deal, because normally it authenticates with per request credentials.

If you don't feel/have the need to support non session authentication, my guess is you could simply overwrite the handle_unverified_request method in your application controller to throw an exception again. But I would wait for further explanation by the rails core team.