# ActionController::InvalidAuthenticityToken & :before

**URL:** <https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-before/169508>\
**Category:** Rails\
**Created:** [June 4, 2009, 5:44pm UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-before/169508 "2009-06-04T17:44:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mk27](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/5e9695/32.png) [@mk27](https://www.ruby-forum.com/u/mk27)\
**Post date:** [June 4, 2009, 5:44pm UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-before/169508/1 "2009-06-04T17:44:47Z")

</div>

I have a form that submits search criteria and while it is processing I  
wanted to use a js function to indicate:

\<% form\_remote\_tag :update =\> ‘mainbody’, :url =\> {:action =\> ‘search’},  
:before =\> “wait\_message(‘mainbody’,‘S E A R C H I N G’)” do%\>

wait\_message() executes but then when the data comes back, I get

ActionController::InvalidAuthenticityToken in DocdirController#search

Everything works fine without the :before =\> callback. How should I do  
this?

---

<div class="post-metadata">

**Author:** ![mk27](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/5e9695/32.png) [@mk27](https://www.ruby-forum.com/u/mk27)\
**Post date:** [June 4, 2009, 6:43pm UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-before/169508/2 "2009-06-04T18:43:11Z")

</div>

Here are more details from that error:

Processing DocdirController#search (for 127.0.0.1 at 2009-06-04  
11:34:39) [POST]

ActionController::InvalidAuthenticityToken  
(ActionController::InvalidAuthenticityToken):  
internal:prelude:8:in `synchronize' /usr/local/lib/ruby/1.9.1/webrick/httpserver.rb:111:in`service’  
/usr/local/lib/ruby/1.9.1/webrick/httpserver.rb:70:in `run' /usr/local/lib/ruby/1.9.1/webrick/server.rb:183:in`block in  
start\_thread’

---

<div class="post-metadata">

**Author:** ![mk27](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/5e9695/32.png) [@mk27](https://www.ruby-forum.com/u/mk27)\
**Post date:** [June 4, 2009, 10:14pm UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-before/169508/3 "2009-06-04T22:14:26Z")

</div>

I suppose it was not a good idea to replace the form with “removeChild”  
:before the form is submitted…

---

<div class="post-metadata">

**Author:** ![mk27](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/5e9695/32.png) [@mk27](https://www.ruby-forum.com/u/mk27)\
**Post date:** [June 5, 2009, 1:16pm UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-before/169508/4 "2009-06-05T13:16:54Z")

</div>

In your controller add  
skip\_before\_filter :verify\_authenticity\_token

Hope this will help !

Sandip R~

–  
Ruby on Rails Developer

> **[Blogs - Neuigkeiten - Artikel - Webseiten - Medien](https://www.sosblog.com/)**
>
> Auf SOSblog geht es um aktuelle Blogs, Neuigkeiten, Artikel, Webseiten und Medien. Wir bringen interessante neue Webseiten aus den Tiefen des Webs.

> **[Judul Situs](https://funonrails.wordpress.com/)**
>
> “Cinta tidak mengenal batas. Cinta mampu melewati rintangan, melompati pagar, menembus dinding untuk mencapai tujuannya dengan penuh harapan.” — Maya Angelou

> **[Josh Software | Custom Software Development Services & Solutions](https://joshsoftware.com/)**
>
> JoshSoftware offers custom software development Services & Solution that provides enterprise, software development services for web & mobile.

---

<div class="post-metadata">

**Author:** ![mk27](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/5e9695/32.png) [@mk27](https://www.ruby-forum.com/u/mk27)\
**Post date:** [June 5, 2009, 6:22pm UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-before/169508/5 "2009-06-05T18:22:21Z")

</div>

Sandip R. wrote:

> In your controller add  
> skip\_before\_filter :verify\_authenticity\_token
> 
> Hope this will help !

Thanks for that tidbit, but the problem was that the wait\_message()  
function destroyed the content of the div with the form in it and  
replaced it with the message, S E A R C H I N G

Of course, the form is not yet submitted and it contained the auth token  
in a hidden field! So the more is: don’t destroy the form in your  
:before callback.