# ActiveResource and InvalidAuthenticityToken exception **URL:** \ **Category:** Rails\ **Created:** [September 28, 2008, 8:19am UTC](https://www.ruby-forum.com/t/activeresource-and-invalidauthenticitytoken-exception/149686 "2008-09-28T08:19:08Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![jeff](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e19b73/32.png) [@jeff](https://www.ruby-forum.com/u/jeff)\ **Post date:** [September 28, 2008, 8:19am UTC](https://www.ruby-forum.com/t/activeresource-and-invalidauthenticitytoken-exception/149686/1 "2008-09-28T08:19:08Z")
Hi, I have a Rails 2.1.1 web app, and a Rails 2.1.1 app acting as a client by using ActiveResource. From the client, I can find, create, and update resources owned by the web app. However, I can not delete any. Calling the .destroy method in ActiveResource generates a 422 from the web app. Not sure why this would be the case, since I thought protect\_from\_forgery only protects HTML and JS requests. Any idea if this is a bug in ActiveResource that I should dig into, or is this actually by design and I’m not understanding something about how to achieve deletes via ActiveResource? Thanks! Jeff ---
**Author:** ![jeff](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e19b73/32.png) [@jeff](https://www.ruby-forum.com/u/jeff)\ **Post date:** [September 29, 2008, 7:15pm UTC](https://www.ruby-forum.com/t/activeresource-and-invalidauthenticitytoken-exception/149686/2 "2008-09-29T19:15:59Z")
Jeff C. wrote: > Hi, > > I have a Rails 2.1.1 web app, and a Rails 2.1.1 app acting as a client > by using ActiveResource. > > From the client, I can find, create, and update resources owned by the > web app. > > However, I can not delete any. Calling the .destroy method in > ActiveResource generates a 422 from the web app. > > Not sure why this would be the case, since I thought > protect\_from\_forgery only protects HTML and JS requests. > > Any idea if this is a bug in ActiveResource that I should dig into, or > is this actually by design and I’m not understanding something about > how to achieve deletes via ActiveResource? > > Thanks! > Jeff Seeing the same thing, using edge on the client and an older snapshot of edge on the server. Going to see if updating the server resolves the issue tonight. ---
**Author:** ![jeff](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e19b73/32.png) [@jeff](https://www.ruby-forum.com/u/jeff)\ **Post date:** [September 29, 2008, 9:32pm UTC](https://www.ruby-forum.com/t/activeresource-and-invalidauthenticitytoken-exception/149686/3 "2008-09-29T21:32:33Z")
On Sep 29, 12:15 pm, Mike V. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > ## Seeing the same thing, using edge on the client and an older snapshot of edge on the server. Going to see if updating the server resolves the issue tonight. > > Posted viahttp://www.ruby-forum.com/. Glad to know it’s not just me. I suspect this is a bug somewhere. Jeff ---
**Author:** ![jeff](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e19b73/32.png) [@jeff](https://www.ruby-forum.com/u/jeff)\ **Post date:** [September 29, 2008, 9:56pm UTC](https://www.ruby-forum.com/t/activeresource-and-invalidauthenticitytoken-exception/149686/4 "2008-09-29T21:56:05Z")
Check my answer on [ruby on rails - How Do I Authenticate to ActiveResource to Avoid the InvalidAuthenticityToken Response? - Stack Overflow](http://stackoverflow.com/questions/150076/how-do-i-authenticate-to-activeresource-to-avoid-the-invalidauthenticitytoken-r#150194). It is not a perfect solution but does provide a workaround. ---
**Author:** ![jeff](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e19b73/32.png) [@jeff](https://www.ruby-forum.com/u/jeff)\ **Post date:** [October 1, 2008, 9:50pm UTC](https://www.ruby-forum.com/t/activeresource-and-invalidauthenticitytoken-exception/149686/5 "2008-10-01T21:50:17Z")
Mike V. wrote: > Jeff C. wrote: > > > Hi, > > > > I have a Rails 2.1.1 web app, and a Rails 2.1.1 app acting as a client > > by using ActiveResource. > > > > From the client, I can find, create, and update resources owned by the > > web app. > > > > However, I can not delete any. Calling the .destroy method in > > ActiveResource generates a 422 from the web app. > > > > Not sure why this would be the case, since I thought > > protect\_from\_forgery only protects HTML and JS requests. > > > > Any idea if this is a bug in ActiveResource that I should dig into, or > > is this actually by design and I’m not understanding something about > > how to achieve deletes via ActiveResource? > > > > Thanks! > > Jeff > > Seeing the same thing, using edge on the client and an older snapshot of > edge on the server. Going to see if updating the server resolves the > issue tonight. Issue persists with latest edge on client/server. ☹ I see there’s a ticket now, too. [http://rails.lighthouseapp.com/projects/8994/tickets/1145-bug-invalidauthenticitytoken-incorrectly-raised-for-xml-controllerdestroy-request](http://rails.lighthouseapp.com/projects/8994/tickets/1145-bug-invalidauthenticitytoken-incorrectly-raised-for-xml-controllerdestroy-request)