Googlebot causes an invalid Cross Origin Request (COR) on Rails 4.1

Question

How do I prevent Google from causing this error while crawling the site? I am not interested in turning off "protect_from_forgery" unless it is safe to do so. ``` [fyi] method=GET path=/users format=*/* controller=users action=show status=200 duration=690.32 view=428.25 db=253.06 time= host= user= user_agent=Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) session= params={""} () [hmm] Security warning: an embedded

Accepted Answer

Googlebot is using the format "*/*" (http://apidock.com/rails/Mime) and the application renders the js since it's the only thing available. Since it's remote, it correctly causes an Invalid COR.

This was reproducible using:

```
curl -H "Accept: */*" https://www.example.com/users/123/flag
```

The fix is to have an html fallback resource for the spider to crawl:

```
respond_to do |format|
  format.html { render template: 'users/flag' }
  format.js { render template: 'users/flag', layout: "some_layout" }
end
```

Googlebot causes an invalid Cross Origin Request (COR) on Rails 4.1

Solution

Problem