# ActionController::InvalidAuthenticityToken in Radiant Admin

**URL:** <https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-in-radiant-admin/139816>\
**Category:** Radiant CMS\
**Created:** [June 7, 2008, 5:00pm UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-in-radiant-admin/139816 "2008-06-07T17:00:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![frycu](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/c4cdca/32.png) [@frycu](https://www.ruby-forum.com/u/frycu)\
**Post date:** [June 7, 2008, 5:00pm UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-in-radiant-admin/139816/1 "2008-06-07T17:00:54Z")

</div>

Hello,  
I have small problem with my Radiant CMS Admin…  
When I try unroll list with childrens, it starts to put such  
communication:

ActionController::InvalidAuthenticityToken in  
Admin/pageController#children

ActionController::InvalidAuthenticityToken  
RAILS\_ROOT: /home/inf\_sto\_2/frycu/public\_html/aniol\_radiant

Application Trace | Framework Trace | Full Trace  
Request

Parameters:

{“level”=\>“2”,  
“id”=\>“5”}

Show session dump

* * *

:return\_to:  
user\_id: 1  
flash: !map:ActionController::Flash::FlashHash {}

Response

Headers:

{“cookie”=\>[],  
“Cache-Control”=\>“no-cache”}

and when I refresh admin site its showing childrens…  
but I want to work it right, any ideas?

---

<div class="post-metadata">

**Author:** ![frycu](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/c4cdca/32.png) [@frycu](https://www.ruby-forum.com/u/frycu)\
**Post date:** [June 7, 2008, 5:38pm UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-in-radiant-admin/139816/2 "2008-06-07T17:38:01Z")

</div>

Make sure that you ran `rake radiant:update` after upgrading your site  
to 0.6.7. We had to make a change in the sitemap.js file to deal with  
this issue. Essentially, retrieving the children of the current page  
should be a ‘get’ request, but the default for Ajax.Request is ‘post’.  
‘get’ requests aren’t checked for authenticity. This was fixed.

Sean

---

<div class="post-metadata">

**Author:** ![frycu](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/c4cdca/32.png) [@frycu](https://www.ruby-forum.com/u/frycu)\
**Post date:** [June 8, 2008, 10:53am UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken-in-radiant-admin/139816/3 "2008-06-08T10:53:15Z")

</div>

Sean C. wrote:

> Make sure that you ran `rake radiant:update` after upgrading your site  
> to 0.6.7. We had to make a change in the sitemap.js file to deal with  
> this issue. Essentially, retrieving the children of the current page  
> should be a ‘get’ request, but the default for Ajax.Request is ‘post’.  
> ‘get’ requests aren’t checked for authenticity. This was fixed.
> 
> Sean

thanks sean it works!!