我已经使用带有Faye in Rails 4.2
的websockets实现了实时聊天现在我可以使用curl向频道发布消息，如：
curl http://localhost:3000/faye -d message={"channel":"/mychannel", "data": "my message"}'
为防止出现这种情况，我按照指南http://faye.jcoglan.com/security/csrf.html
进行了操作但客户端总是有401错误
[,…]
0: {id: "8l", channel: "/meta/handshake", error: "401::Access denied", successful: false, version: "1.0",…}
advice: {reconnect: "handshake"}
channel: "/meta/handshake"
error: "401::Access denied"
id: "8l"
successful: false
supportedConnectionTypes: ["long-polling", "cross-origin-long-polling", "callback-polling", "websocket", "eventsource",…]
version: "1.0"
我还在CsrfProtection扩展名中调试令牌变量。他们总是不同。
Started POST "/faye" for 127.0.0.1 at 2016-02-20 02:53:59 +0600
session_token: "nICoUB0sDiwmNqbRpr1kUM7LtyBybCiddThnZceU7UI="
message_token: "PO5gD5tPwVMZifrUCsk8xnJXUIRZkhOU/vQ+ujbmQAugbshfhmPPfz+/XAWsdFiWvJznpCv+OwmLzFnf8XKtSQ=="
为什么它们有所不同，我如何实施csrf保护？