Rails authorization necessary for post actions? -

i have app i'm writing in rails 3 w/ cancan , devise. i'm curious if authorizing post actions on controllers necessary or helpful security standpoint? assuming controller actions require authentication w/ devise (ie user must logged in).

i can see why need authorization through cancan on controller actions use get's since user can input url wish visit freely , must locked down. however, posts user must post data form, protected against xss attack token.

in case safe assume if limit visibility of, say, button in view cancan user wouldn't able submit form maliciously?

thanks alot

edit:

thanks quick answer guys. has been pointed out below malicious user can forge form post using tools such firebug , authorization necessary.

what best way simulate type of interaction (a user posting url form they've hacked) using capybara / cucumber?

thanks again.

a user can submit post request regardless of whether on website or not. you're correct in thinking security token prevent xss, add authentication in other methods of attacks.

a (free) ebook read if you're concerned security ruby on rails security guide. outlines common forms of malicious attacks , explores of lesser used (but effective) methods. gives great solutions on how make application more secure.