Rails API mode starts with a smaller middleware stack, a controller base class without view or cookie modules, and no session handling. That shrinks the surface, but it also removes helpers you may have relied on. You must add authentication, CORS and caching choices yourself.
What rails new with the api flag does
According to the Rails guide, creating an app with the api flag does three things: it starts with a smaller set of middleware, makes ApplicationController inherit from ActionController::API, and tells generators to skip views, helpers and assets.
Browser oriented middleware is left out by default, including cookie support. The session stores (cache, cookie and memcache) are excluded, along with Rack::MethodOverride, ActionDispatch::Cookies and ActionDispatch::Flash. You can add them back.
What the base controller keeps and drops
| Kept in ActionController::API | Left out |
|---|---|
| Routing URL helpers, redirects | ActionView::Layouts |
| JSON rendering | respond_to support (MimeResponds) |
| Strong parameters | Cookies module |
| Callbacks, rescue_from | Caching module |
| Instrumentation, params wrapping | Translation helper |
Strong parameters being present matters. Mass assignment protection is still available, but you have to use it. See Rails strong parameters, permit, expect and permit bang for how scanners find gaps.
What you must add on purpose
- Authentication. The guide lists HTTP basic, digest and token authentication modules you can include. Most teams choose a library or a token scheme.
- CORS. The guide does not cover cross origin rules, so you will find that elsewhere and configure it deliberately.
- Caching. You set cache_store manually in the controller because Rails does not pass it for you.
- Cookies, only if you need them. Adding cookies means adding the middleware and then thinking about request forgery again.
What this means for scanning
A scanner needs to know how to authenticate. In an API mode app that is usually a bearer token or key, so declare the scheme in your OpenAPI file. The Rails guide does not generate an OpenAPI description, so you either use a separate tool for that or write one and keep it in the repository. Check that the description lists every route, since a scanner can only test what it knows about.
Because API mode removes cookie sessions, classic request forgery tests matter less for pure token APIs, but they matter again if you add cookies back. That topic has its own post: does Rails API mode need CSRF protection.
Common mistakes
- Assuming a smaller stack means a safer one. Fewer defaults mean fewer guardrails you did not write.
- Leaving permit with an empty hash for a key, which the Rails docs warn opens the door to arbitrary input.
- Forgetting that removed middleware can disable some Action Controller features if you delete more of it.
Try it yourself
Click through it at your own pace, or open it full screen. Check how the scan handles authentication before it tests routes.
Safeguard's dependency scanning reads a Gemfile lock the same way it reads other manifests, and a free scan is available.
Quick check
Does API mode include sessions?
Not by default. The session middleware is excluded, though you can add it back with the right configuration.
Is a Rails API app safer than a full stack one?
It has a smaller default surface, but authentication, CORS and input handling are still your responsibility.
Sources
Last reviewed: 19 October 2026.
