Preventing CSRF with protect_from_forgery?

Question

Ruby on Rails

Good afternoon, in the ApplicationController, from which all other controllers in my application are inherited, I did:

class ApplicationController < ActionController::Base
  # Prevent CSRF attacks by raising an exception.
  # For APIs, you may want to use :null_session instead.
  protect_from_forgery with: :null_session

 ...
end

Instead of:
protect_from_forgery with: :exception
Running brakeman to find out how many security bugs my application saw, he recommends using:
protect_from_forgery with: :exception
Question: How can protect_from_forgery with: :null_session harm web application security? I read the documentation, tried to perform a CSRF attack manually, I failed, instead of an exceptional situation, I find myself on the main page of my application, and the action on which I attacked did not execute.