# ActionController::InvalidAuthenticityToken in LoginController

**URL:** <https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-in-logincontroller/126182>\
**Category:** Rails\
**Created:** [January 16, 2008, 3:46am UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-in-logincontroller/126182 "2008-01-16T03:46:31Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Double](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/8baadc/32.png) [@Double](https://www.ruby-forum.com/u/Double)\
**Post date:** [January 16, 2008, 3:46am UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-in-logincontroller/126182/1 "2008-01-16T03:46:31Z")

</div>

Hi,

I’m having a problem trying to get a login controller working. When I  
try and post to my login controller I get the following error:

ActionController::InvalidAuthenticityToken in LoginController#login

login\_controller:

class LoginController \< ApplicationController  
def login  
case request.method  
when :post  
if @session[‘user’] = User.authenticate(@params[‘username’],  
@params[‘password’])

```
      flash['notice'] = "Login successful"
      redirect_back_or_default :action => "welcome"
    else
      @login = @params['username']
      @message = "Login unsuccessful"
      redirect_to :action=> "login"
  end
end

```

end  
…

login.html.erb:

# Please Login

```
<form method="post" action="">
  <p><label for="user_login">Username</label>
    <%= text_field "user", "username", :class => 'textbox', :value

```

=\> ‘’, :maxlength =\> 40 %\>

  

Password  
\<%= password\_field “user”, “password”, :class =\>  
‘textbox’, :value =\> ‘’, :maxlength =\> 40 %\>

  

\<%= submit\_tag ‘Login’, :class =\> ‘button’ %\>

  

User.rb

class User \< ActiveRecord::Base

def self.authenticate(login, pass)  
User.find(:first, :conditions =\>[“username = ? AND password = ?”,  
login, sha1(pass)])  
end

def change\_password(pass)  
update\_attribute “password”, self.class.sha1(pass)  
end

protected

def self.sha1(pass)  
Digest::SHA1.hexdigest(“somedigest”)  
end

before\_create :crypt\_password

def crypt\_password  
write\_attribute(“password”, self.class.sha1(password))  
end

validates\_length\_of :login, :within =\> 3…40  
validates\_length\_of :password, :within =\> 5…40  
validates\_presence\_of :login, :password, :password\_confirmation  
validates\_uniqueness\_of :login, :on =\> :create  
validates\_confirmation\_of :password, :on =\> :create  
end

I have the :secret and :session\_key set in the environment.rb

Does anyone have any ideas?

---

<div class="post-metadata">

**Author:** ![Double](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/8baadc/32.png) [@Double](https://www.ruby-forum.com/u/Double)\
**Post date:** [January 16, 2008, 4:16am UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-in-logincontroller/126182/2 "2008-01-16T04:16:19Z")

</div>

2008/1/16, Double [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> I’m having a problem trying to get a login controller working. When I  
> try and post to my login controller I get the following error:
> 
> ActionController::InvalidAuthenticityToken in LoginController#login

[…]

> ```
> <%= password_field "user", "password", :class =>
> 
> ```
> 
> ‘textbox’, :value =\> ‘’, :maxlength =\> 40 %\>
> 
>   
> 
> \<%= submit\_tag ‘Login’, :class =\> ‘button’ %\>

You should use the token\_tag helper in your form to provide  
the secret token needed by Rails for CSRF security reasons.

– Jean-François.

---

<div class="post-metadata">

**Author:** ![Double](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/8baadc/32.png) [@Double](https://www.ruby-forum.com/u/Double)\
**Post date:** [January 16, 2008, 4:22am UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-in-logincontroller/126182/3 "2008-01-16T04:22:44Z")

</div>

Are you saying that is the problem or are you making that suggestion  
for simply security reasons?

On Jan 15, 10:15 pm, “Jean-François Trân” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![Double](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/8baadc/32.png) [@Double](https://www.ruby-forum.com/u/Double)\
**Post date:** [January 16, 2008, 4:33am UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-in-logincontroller/126182/4 "2008-01-16T04:33:15Z")

</div>

Forget it - got it. Thank you for the help. This worked like a charm.

\<%= token\_tag %\>

---

<div class="post-metadata">

**Author:** ![Double](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/8baadc/32.png) [@Double](https://www.ruby-forum.com/u/Double)\
**Post date:** [January 21, 2008, 11:45am UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-in-logincontroller/126182/5 "2008-01-21T11:45:49Z")

</div>

HI I’m having that same exact problem while following “rails  
solutions” book excercises.

the difference is that I’m still new to RoR that i couldn’t get it to  
work with \<%= token\_tag %\>  
didn’t find much on the net either.

where should i add this tag and how is it used? is there any extra  
params to add to it?

in my view I have:  
\<%= form\_tag({:controller =\> ‘user’, :action =\> ‘login’},{:id  
=\>“login\_form”})%\>  
Login:  
  
\<%= text\_field :user, :login %\>  
  
Password:  
  
\<%= password\_field :user, :password%\>  
  
\<%= submit\_tag ‘Login’ %\>  
\<% $end %\>

this happened after I uncommented in environment.rb and restarted the  
server  
config.action\_controller.session\_store = :active\_record\_store

if it worked for you please help me out on that one.  
cheers.