call me a bad coder but when I used rails 2.3 I had never seen it in production code. Ok, then you're a bad coder. All Rails applications I've ever worked on

call me a bad coder but when I used rails 2.3 I had never seen it in production code. Ok, then you're a bad coder. All Rails applications I've ever worked on had those checks and the documentation for Rails made it pretty clear that verify :method should be used for non-GET requests. Anyways rails 2.3 had no csrf protection You really need to check your facts. Rails has had protect_from_forgery since at least 2.2 and it was enabled by default in ApplicationController. Rails < 2.3.10 did not do the verification for AJAX requests, but this was changed in 2.3.11. Added in 2007: https://github.com/rails/rails/commit/4e3ed5bc44f6cd20c9e353ab63fd24b92a7942be https://github.com/rails/rails/commit/4e3ed5bc44f6cd20c9e353... and made the default shortly after.