Currently CSRF protection relies on the presence of an authentication token, this must be passed with all requests to enjoy the benefits. This is makes hand written Ajax.Request calls difficult to code, you'll have to pass auth_token but you only don't know this at javascript source file level. Workarounds exists like storing the auth_token in a JS variable on page load than manually passing this in to ever Ajax Request call you'll write. Sounds fishy and it is.
I propose instead changing the protoype.js code to double submit all cookies in a _cookie parameter added automatically to every ajax request. Due to browser security rules only valid JS code would be able to read the cookies and send the _cookie along. At rails level we would check if the cookie arriving via the parameter hash matches the one we got from the browser via HTTP_COOKIE. If yes request is certainly valid even if the auth token is not present. This effectively fixes the CSRF problem for Ajax requests in globally whilst lifting the requirement of manual auth_token passing away.
Just have to see the path taken by current rails helpers generating JS code and be amazed how many times this auth_token appears. Tickets #10700, #10059, #10055
and #9731 are all about this.
Attached patch adds this feature, solving all of the above tickets. In a second step we could remove the auth_token parameter from all code generated by link_to_remote, form_remote_for etc.
