Returns true or false if a request is verified. Checks:

• is the format restricted? By default, only HTML and AJAX requests are checked.
• is it a GET request? Gets should be safe and idempotent
• Does the form_authenticity_token match the given _token value from the params?

Source Code

# File action_controller/request_forgery_protection.rb, line 94
def verified_request?
  !protect_against_forgery?     ||
    request.method == :get      ||
    !verifiable_request_format? ||
    form_authenticity_token == params[request_forgery_protection_token]
end