# Ajax and Rails 2.0

**URL:** <https://www.ruby-forum.com/t/ajax-and-rails-2-0/125083>\
**Category:** Rails\
**Created:** [January 5, 2008, 4:50am UTC](https://www.ruby-forum.com/t/ajax-and-rails-2-0/125083 "2008-01-05T04:50:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![brianspaid](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/82dd89/32.png) [@brianspaid](https://www.ruby-forum.com/u/brianspaid)\
**Post date:** [January 5, 2008, 4:50am UTC](https://www.ruby-forum.com/t/ajax-and-rails-2-0/125083/1 "2008-01-05T04:50:03Z")

</div>

I was trying to do an ajax destroy in Rails 2.0 and whenever the call  
is made I get this error: ActionController::InvalidAuthenticityToken.  
Anyone have any ideas?

---

<div class="post-metadata">

**Author:** ![brianspaid](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/82dd89/32.png) [@brianspaid](https://www.ruby-forum.com/u/brianspaid)\
**Post date:** [January 11, 2008, 1:29pm UTC](https://www.ruby-forum.com/t/ajax-and-rails-2-0/125083/2 "2008-01-11T13:29:40Z")

</div>

I fixed it by putting in a hidden field with the authenticity\_token

---

<div class="post-metadata">

**Author:** ![brianspaid](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/82dd89/32.png) [@brianspaid](https://www.ruby-forum.com/u/brianspaid)\
**Post date:** [February 4, 2008, 3:28am UTC](https://www.ruby-forum.com/t/ajax-and-rails-2-0/125083/3 "2008-02-04T03:28:54Z")

</div>

How did you fix it?

I’d like to have the ‘destroy’ link in index.html.erb be a  
link\_to\_remote, but I get the same CSRF error. There is no form to put  
a hidden field in on that page. link\_to\_remote does have a tolken  
generated, but it does not seem to work.

I got it working just fine but disabling the CSRF, but that’s not what  
I would want in production.

Running Rails 2.0.2 / Ruby 1.8.6 on cygwin/windows.

---

<div class="post-metadata">

**Author:** ![brianspaid](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/82dd89/32.png) [@brianspaid](https://www.ruby-forum.com/u/brianspaid)\
**Post date:** [February 6, 2008, 3:42pm UTC](https://www.ruby-forum.com/t/ajax-and-rails-2-0/125083/4 "2008-02-06T15:42:32Z")

</div>

On my side, i have created a helper to write security token on to the  
page. So you have to change you xhr request to append the token.

```
   def security_informations
           return "
           <script type='text/javascript'>
           var Security = {
                   token_name: '%s',
                   token_value: '%s',
                   xhr_extra_params: {
                           %s: '%s'
                   }
           }
           </script>
           " % 

```

[request\_forgery\_protection\_token,form\_authenticity\_token,  
request\_forgery\_protection\_token,  
form\_authenticity\_token]  
end

I am quite new in RoR, so maybe they is a better way to do so …

Thomas