API-only application setup in Ruby on Rails - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the default middleware stack in a Rails API-only app?

In a Rails API-only application, which middleware is excluded by default compared to a full Rails app?

A Request ID middleware is excluded by default.

B Static file server middleware is excluded by default.

C Session and cookie middleware are excluded by default.

D Logger middleware is excluded by default.

💡 Hint

Think about what an API-only app does not need compared to a full web app.

API-only apps do not use sessions or cookies by default, so their middleware is excluded. Other middleware like logging and request ID remain.

📝 Syntax

intermediate

How to generate a new Rails API-only app?

Which command correctly creates a new Rails API-only application named my_api?

A rails new my_api --only-api

B rails new my_api --api

C rails new my_api --api-only

D rails new my_api --api_mode

💡 Hint

The flag is short and starts with two dashes.

The correct flag to create an API-only Rails app is --api.

❓ state_output

advanced

What is the default response format in Rails API-only controllers?

Given a Rails API-only controller without explicit format settings, what is the default response format when a client requests data?

Ruby on Rails

class BooksController < ApplicationController
  def index
    render json: { books: ['Ruby', 'Rails'] }
  end
end

A Plain text

B XML

C HTML

D JSON

💡 Hint

API-only apps focus on data exchange formats.

Rails API-only apps default to JSON responses for data rendering.

🔧 Debug

advanced

Why does this API-only app raise a Missing CSRF Token error?

Consider this Rails API-only app controller code:

class PostsController < ApplicationController
  protect_from_forgery with: :exception

  def create
    render json: { status: 'ok' }
  end
end

Why does this cause a CSRF token missing error when posting?

Ruby on Rails

class PostsController < ApplicationController
  protect_from_forgery with: :exception

  def create
    render json: { status: 'ok' }
  end
end

A API-only apps disable CSRF protection by default; enabling it causes errors without tokens.

B The controller is missing a before_action to authenticate the user.

C The render json call is incorrect and causes the error.

D The routes file is missing the POST route for create.

💡 Hint

Think about what Rails disables by default in API-only mode.

CSRF protection is disabled by default in API-only apps because APIs usually use tokens or other auth methods. Enabling it without tokens causes errors.

🧠 Conceptual

expert

What is the main reason to choose API-only mode in Rails?

Why would a developer choose to create a Rails application with the --api flag instead of a full Rails app?

A To build a lightweight backend focused on JSON APIs without views or assets.

B To enable automatic generation of HTML views and layouts.

C To create a full-stack app with integrated frontend templates.

D To include all default middleware for session and cookie management.

💡 Hint

Think about what an API-only app does NOT include.

API-only mode creates a slim backend focused on serving JSON data, skipping views, assets, and session middleware.