# ActionController::InvalidAuthenticityToken (ActionController

**URL:** <https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-actioncontroller/124022>\
**Category:** Rails\
**Created:** [December 23, 2007, 5:22pm UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-actioncontroller/124022 "2007-12-23T17:22:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![milazzo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/dec6dc/32.png) [@milazzo](https://www.ruby-forum.com/u/milazzo)\
**Post date:** [December 23, 2007, 5:22pm UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-actioncontroller/124022/1 "2007-12-23T17:22:47Z")

</div>

having just updated to Rails 2.0 I’m getting problems with:

ActionController::InvalidAuthenticityToken  
(ActionController::InvalidAuthenticityToken):

On most of my pages it works fine, but with some of them I just get a  
blank screen.

I read somewhere that this was down to the secret key defined in  
environment.rb and that it was possible to just comment this part out.  
But such a simple fix alas doesn’t seem to work for me.

I don’t honestly need this level of authenticity so could happily live  
without it. Is there a quick fix?

Thanks to anyone who can help.

---

<div class="post-metadata">

**Author:** ![milazzo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/dec6dc/32.png) [@milazzo](https://www.ruby-forum.com/u/milazzo)\
**Post date:** [December 23, 2007, 11:47pm UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-actioncontroller/124022/2 "2007-12-23T23:47:24Z")

</div>

Set this in your controller class definition  
protect\_from\_forgery :only =\> [:create, :update, :destroy]

On Dec 24, 2007 2:52 AM, dc dc [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> environment.rb and that it was possible to just comment this part out.

–  
Ryan B.

> **[frozenplague.net](http://www.frozenplague.net)**
>
> This domain may be for sale!

Feel free to add me to MSN and/or GTalk as this email.

---

<div class="post-metadata">

**Author:** ![milazzo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/dec6dc/32.png) [@milazzo](https://www.ruby-forum.com/u/milazzo)\
**Post date:** [March 20, 2008, 3:14pm UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-actioncontroller/124022/3 "2008-03-20T15:14:57Z")

</div>

Hi guys,

What I do is that I allow the creation of a comment from a mobile device  
using XML sending:

\<?xml version="1.0" encoding="UTF-8"?\> Comment from curl

To [http://user1:pass1@127.0.0.1](http://user1:pass1@127.0.0.1).:3000/programs/1/comments

So I used protect\_from\_forgery :only =\> [:update, :destroy] to be able  
to access the :create

But now it is open. As you can see in the request I put the username and  
password so the comment can be created.

How should I do this in a secure way? Both regarding the  
protect\_from\_forgery and the username and password transfer?

Thanks!

---

<div class="post-metadata">

**Author:** ![milazzo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/dec6dc/32.png) [@milazzo](https://www.ruby-forum.com/u/milazzo)\
**Post date:** [April 9, 2008, 6:41pm UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-actioncontroller/124022/4 "2008-04-09T18:41:40Z")

</div>

The protect\_from\_forgery :only =\> [:create, :update, :destroy] is  
exactly what i needed to make my auto\_complete work. Thanks alot 🙂

---

<div class="post-metadata">

**Author:** ![milazzo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/dec6dc/32.png) [@milazzo](https://www.ruby-forum.com/u/milazzo)\
**Post date:** [April 19, 2008, 10:47am UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-actioncontroller/124022/5 "2008-04-19T10:47:47Z")

</div>

could you try to include prototype in your layout? It’s work for me 🙂