Skip to content

Return a blank JSON response for a missing .js file to prevent Rails CSRF errors

Stan Hu requested to merge sh-fix-cross-site-forgery-errors into master

The default 404 handler would return the Content-Type format based on the given format extension. This would cause the Rails CSRF protection to flag an error, since the .js extension gets mapped to text/javascript format.

Closes #40771 (closed)

Merge request reports