# Active\_record\_store sessions does not pass a :secret to #protect\_from\_forgery in Rails 2.0.0 Preview

**URL:** <https://www.ruby-forum.com/t/active-record-store-sessions-does-not-pass-a-secret-to-protect-from-forgery-in-rails-2-0-0-preview/116268>\
**Category:** Rails\
**Created:** [October 4, 2007, 12:07am UTC](https://www.ruby-forum.com/t/active-record-store-sessions-does-not-pass-a-secret-to-protect-from-forgery-in-rails-2-0-0-preview/116268 "2007-10-04T00:07:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![riles01](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/59ef9b/32.png) [@riles01](https://www.ruby-forum.com/u/riles01)\
**Post date:** [October 4, 2007, 12:07am UTC](https://www.ruby-forum.com/t/active-record-store-sessions-does-not-pass-a-secret-to-protect-from-forgery-in-rails-2-0-0-preview/116268/1 "2007-10-04T00:07:33Z")

</div>

After switching to active\_record\_store to host sessions, I now get the  
following errors:

ActionController::InvalidAuthenticityToken in Pages#edit  
Showing app/views/pages/edit.html.erb where line #5 raised:

No :secret given to the #protect\_from\_forgery call. Set that or use a  
session store capable of generating its own keys (Cookie Session  
Store).

Extracted source (around line #5):

2:  
3: \<%= error\_messages\_for :page %\>  
4:  
5: \<% form\_for(@page) do |f| %\>  
6:

7: **Name**  
  
8: \<%= f.text\_field :name %\>

RAILS\_ROOT: C:/www/rails\_apps/myapp

Application Trace | Framework Trace | Full Trace  
c:/www/ruby/lib/ruby/gems/1.8/gems/actionpack-1.13.3.7707/lib/  
action\_controller/request\_forgery\_protection.rb:101:in  
`form_authenticity_token' (eval):2:in`send’  
(eval):2:in `form_authenticity_token' app/views/pages/edit.html.erb:5:in`\_run\_erb\_47app47views47pages47edit46html46erb’

Do I need to do something else besides create the database table and  
uncomment the line in config/environment.rb?

---

<div class="post-metadata">

**Author:** ![riles01](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/59ef9b/32.png) [@riles01](https://www.ruby-forum.com/u/riles01)\
**Post date:** [November 9, 2007, 5:28pm UTC](https://www.ruby-forum.com/t/active-record-store-sessions-does-not-pass-a-secret-to-protect-from-forgery-in-rails-2-0-0-preview/116268/2 "2007-11-09T17:28:09Z")

</div>

Hello riles01, you have run your application with cookies  
authentication mode and, thus, will remain sessions in your cookies.  
Delete your cookies and it will work.

---

<div class="post-metadata">

**Author:** ![riles01](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/59ef9b/32.png) [@riles01](https://www.ruby-forum.com/u/riles01)\
**Post date:** [November 12, 2007, 1:25pm UTC](https://www.ruby-forum.com/t/active-record-store-sessions-does-not-pass-a-secret-to-protect-from-forgery-in-rails-2-0-0-preview/116268/3 "2007-11-12T13:25:49Z")

</div>

sorry, it seem work well, but no. in your environement.rb you have :

config.action\_controller.session = {  
:session\_key =\> ‘\_myapp\_session’,  
:secret =\> ‘secretpass’  
}

uncomment  
config.action\_controller.session\_store = :active\_record\_store

and add in your app/controller/application.rb  
protect\_from\_forgery :secret =\> ‘secretpass’

and all work well.