# ActionController::InvalidAuthenticityToken

**URL:** <https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken/127736>\
**Category:** Rails\
**Created:** [January 31, 2008, 8:45pm UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken/127736 "2008-01-31T20:45:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bluetrust](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/8e7dd6/32.png) [@bluetrust](https://www.ruby-forum.com/u/bluetrust)\
**Post date:** [January 31, 2008, 8:45pm UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken/127736/1 "2008-01-31T20:45:03Z")

</div>

I am new to RoR. I am running Linux Red Hat Enterprise with MySQL for  
my db, and when I go and either create/update the database I get this  
message:

ActionController::InvalidAuthenticityToken in Test1Controller#create(or  
update)  
ActionController::InvalidAuthenticityToken

I can destroy any of the items in the db, just can not create or update.  
The answer is probably simple, but I just have not found it yet…if  
more information is needed please let me know.

---

<div class="post-metadata">

**Author:** ![bluetrust](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/8e7dd6/32.png) [@bluetrust](https://www.ruby-forum.com/u/bluetrust)\
**Post date:** [January 31, 2008, 11:03pm UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken/127736/2 "2008-01-31T23:03:06Z")

</div>

Hi Michael,

This article will explain what this error message is about.  
[http://ryandaigle.com/articles/2007/9/24/what-s-new-in-edge-rails-better-cross-site-request-forging-prevention](http://ryandaigle.com/articles/2007/9/24/what-s-new-in-edge-rails-better-cross-site-request-forging-prevention)

Hope this helps,

Scott

Michael Jubin wrote:

> I am new to RoR. I am running Linux Red Hat Enterprise with MySQL for  
> my db, and when I go and either create/update the database I get this  
> message:
> 
> ActionController::InvalidAuthenticityToken in Test1Controller#create(or  
> update)  
> ActionController::InvalidAuthenticityToken

---

<div class="post-metadata">

**Author:** ![bluetrust](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/8e7dd6/32.png) [@bluetrust](https://www.ruby-forum.com/u/bluetrust)\
**Post date:** [April 19, 2008, 10:45am UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken/127736/3 "2008-04-19T10:45:26Z")

</div>

could try to include prototype in your layout? It’s work for me :)A

---

<div class="post-metadata">

**Author:** ![bluetrust](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/8e7dd6/32.png) [@bluetrust](https://www.ruby-forum.com/u/bluetrust)\
**Post date:** [January 13, 2010, 7:27am UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken/127736/4 "2010-01-13T07:27:50Z")

</div>

Michael Jubin wrote:

> I am new to RoR. I am running Linux Red Hat Enterprise with MySQL for  
> my db, and when I go and either create/update the database I get this  
> message:
> 
> ActionController::InvalidAuthenticityToken in Test1Controller#create(or  
> update)  
> ActionController::InvalidAuthenticityToken
> 
> I can destroy any of the items in the db, just can not create or update.  
> The answer is probably simple, but I just have not found it yet…if  
> more information is needed please let me know.

I added the lines :only =\> [:update, :delete, :create] after  
protect\_from\_forgery and things worked.

I’m on rails 2.3+