diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 3e7d51ff7b7..60c9e82131c 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 class ApplicationController < ActionController::Base
-  protect_from_forgery unless: -> { request.format.json? }
+  protect_from_forgery with: :exception
   around_action :custom_set_locale_from_url
 
   add_flash_types :info, :error, :success, :warning