# ActionController::InvalidAuthenticityToken? **URL:** \ **Category:** Rails\ **Created:** [November 30, 2008, 3:54am UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken/154468 "2008-11-30T03:54:17Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![pete](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/3ab097/32.png) [@pete](https://www.ruby-forum.com/u/pete)\ **Post date:** [November 30, 2008, 3:54am UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken/154468/1 "2008-11-30T03:54:17Z")
Hi- I am trying to use AJAX calls to login and logout of my Rails app so that the form renders in the side bar when you are not logged in, and your “profile” renders if you are. It all works, but when you logout, and try and log back in, you get “ActionController::InvalidAuthenticityToken”, in the development.log. What does this mean, I can’t figure out how to fix this?? Thanks! ---
**Author:** ![pete](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/3ab097/32.png) [@pete](https://www.ruby-forum.com/u/pete)\ **Post date:** [November 30, 2008, 4:25am UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken/154468/2 "2008-11-30T04:25:15Z")
[http://alwaysmovefast.com/2008/01/30/ajax-in-rails-with-authenticity-token/](http://alwaysmovefast.com/2008/01/30/ajax-in-rails-with-authenticity-token/) – James M. ---
**Author:** ![pete](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/3ab097/32.png) [@pete](https://www.ruby-forum.com/u/pete)\ **Post date:** [November 30, 2008, 4:42am UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken/154468/3 "2008-11-30T04:42:13Z")
What if I’m using the cookie\_session\_store? ---
**Author:** ![pete](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/3ab097/32.png) [@pete](https://www.ruby-forum.com/u/pete)\ **Post date:** [November 30, 2008, 5:07am UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken/154468/4 "2008-11-30T05:07:56Z")
Also, if you refresh the page, the problem is fixed. I don’t understand this… Thanks for your feedback. ---
**Author:** ![pete](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/3ab097/32.png) [@pete](https://www.ruby-forum.com/u/pete)\ **Post date:** [November 30, 2008, 5:26am UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken/154468/5 "2008-11-30T05:26:37Z")
The generated token is a one time use token. So, if the page is rendered, and the token value is stored on the page, but you interact with the app via ajax, that token becomes invalid. It’s a way to guarantee that the page rendered was the one submitted and prevents duplicate posting whether on purpose or via the back button. You’ll have to update the form with a new token as part of the ajax interaction. – James M. ---
**Author:** ![pete](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/3ab097/32.png) [@pete](https://www.ruby-forum.com/u/pete)\ **Post date:** [November 30, 2008, 5:53am UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken/154468/6 "2008-11-30T05:53:30Z")
Ah, ok, so the suggestion is to add a hidden field with the \<%= form\_authenticity\_token %\> in it? Thanks again, I’ve been messing with this all day… ---
**Author:** ![pete](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/3ab097/32.png) [@pete](https://www.ruby-forum.com/u/pete)\ **Post date:** [February 10, 2009, 6:19pm UTC](https://www.ruby-forum.com/t/actioncontroller-invalidauthenticitytoken/154468/7 "2009-02-10T18:19:02Z")
pete wrote: > Ah, ok, so the suggestion is to add a hidden field with the \<%= > form\_authenticity\_token %\> in it? > > Thanks again, I’ve been messing with this all day… Did you solved your problem ? I’m having the same trouble, but in my source html page I can see the token there: No matter wich action I I call, it never fires. I suppose Rails is intercepting and stopping it because the token problem. any ideas ? thanks, r.