I don't LOVE the default implementation in Rails 3.2.19 or Rails 4. It seems like they're trying to be overly clever (clearing authentication info but letting the request go through) when, as shown here, that opens up potential security lapses while not really offering anything.

In Microsoft's MVC they simply just throw an exception when a CSRF token mismatch occurs. That to me is rational. It stops the request dead in its tracks, there's no gotchas and no potential exploits in the future (that might be application specific).

I guess it seems like Rail's approach is depending on a blacklist (i.e. "here are things a CSRF failed request cannot contain, everything else is just fine") whereas Microsoft's approach is just to assume the whole request is bad, then let the application author manually write in overrides if they know better (or to just pick up the exception and handle that).

Frankly the author's solution is what Rails should be doing:

     def handle_unverified_request
         raise(ActionController::InvalidAuthenticityToken)
     end