Small helper to allow generating forms without authenticity_token (when you have protect_from_forgery globally active).

without_forgery_protection.rb

# lib/forgery_protection_helpers.rb
module ForgeryProtectionHelpers
  def without_forgery_protection
    return unless block_given? && respond_to?(:controller)
    original_value = controller.allow_forgery_protection
    controller.allow_forgery_protection = false
    result = yield
    controller.allow_forgery_protection = original_value
    result
  end
end

# app/application_controller.rb
class ApplicationController
  protect_from_forgery
  helper ForgeryProtectionHelpers
end

# app/views/foo/form.html.erb
<% without_forgery_protection do %>
	<% form_for ... %>
		<!-- no authentisity token hidden field will be added to this form -->
	<% end %>
<% end %>

Long story short, I needed to make a form to a third-party service, using form_tag, but without that authenticity_token parameter in the form (it was breaking stuff on the third-party service — you don't want to know why...)

Fair enough. I would consider not using form_for, but going with vanilla text_field_tag, though. I think it sends a better message to the reader.