# (2.3.5) ActionController::Base.session\_options\[:expire\_after\] + Error 422/Authenticity Token Issue

**URL:** <https://www.ruby-forum.com/t/2-3-5-actioncontroller-base-session-options-expire-after-error-422-authenticity-token-issue/181956>\
**Category:** Rails\
**Created:** [January 20, 2010, 7:34pm UTC](https://www.ruby-forum.com/t/2-3-5-actioncontroller-base-session-options-expire-after-error-422-authenticity-token-issue/181956 "2010-01-20T19:34:03Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Phoenix\_R](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/5e9695/32.png) [@Phoenix\_R](https://www.ruby-forum.com/u/Phoenix_R)\
**Post date:** [January 20, 2010, 7:34pm UTC](https://www.ruby-forum.com/t/2-3-5-actioncontroller-base-session-options-expire-after-error-422-authenticity-token-issue/181956/1 "2010-01-20T19:34:03Z")

</div>

I’m getting ready to put an app into production and I’ve found a  
strange issue that, as far as I know, shouldn’t be happening. To me  
this looks like it could be a bug, but I’m not sure and I’m hoping  
some one here can tell me if they’ve seen this before, or can idiot-  
check me in that hopefully it’s just something I’ve missed along the  
way.

I need the application to automatically shut down an active session  
after 15 minutes of inactivity. My understanding is that this is  
accomplished, in 2.3.5, with ActionController::Base.session\_options  
[:expire\_after].

In the code snippet below (currently in config/initializers/  
session\_store.rb), I’m forcing this behavior if RAILS\_ENV isn’t  
development (because in development I don’t want this going on - it’s  
annoying to have to relog after making UI/CSS/markup changes every  
time!)

# Force sessions to expire after 15 minutes

if(RAILS\_ENV != ‘development’)  
ActionController::Base.session\_options[:expire\_after] = 15.minutes  
end

This causes a problem: when attempting to login via any browser or any  
machine, the application responds as it should, but claims that the  
authenticity token was invalid, presenting the 422 error message in  
production:

"The change you wanted was rejected.

Maybe you tried to change something you didn’t have access to."

Disabling (commenting) the :expire\_after line solves this problem.

Has anyone else seen this behavior? Have I overlooked something?  
Thanks for your help.