# Authenticity Token change under 2.2.2?

**URL:** <https://www.ruby-forum.com/t/authenticity-token-change-under-2-2-2/154692>\
**Category:** Rails\
**Created:** [December 3, 2008, 1:10am UTC](https://www.ruby-forum.com/t/authenticity-token-change-under-2-2-2/154692 "2008-12-03T01:10:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sijomo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/87869e/32.png) [@sijomo](https://www.ruby-forum.com/u/sijomo)\
**Post date:** [December 3, 2008, 1:10am UTC](https://www.ruby-forum.com/t/authenticity-token-change-under-2-2-2/154692/1 "2008-12-03T01:10:34Z")

</div>

Hi,

We have the following code which sends a request on unload of one of our  
pages. It was working fine until I upgraded to rails 2.2.2, but now is  
giving ‘ActionController::InvalidAuthenticityToken  
(ActionController::InvalidAuthenticityToken):’

Does anyone know what has changed, and what I have to do to get it  
working  
again?

var req = new XMLHttpRequest();  
req.open(“POST”, “\<%= url\_for(:action =\> ‘unlock’, :id =\>  
@current\_page.form\_data.id) %\>”, false);  
req.setRequestHeader(“Content-Type”, “text/plain”);  
req.setRequestHeader(“X-Requested-With”, “XMLHttpRequest”);  
req.send("?authenticity\_token="+encodeURIComponent(window.\_token));

Thanks  
Simon

---

<div class="post-metadata">

**Author:** ![sijomo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/87869e/32.png) [@sijomo](https://www.ruby-forum.com/u/sijomo)\
**Post date:** [December 3, 2008, 6:13am UTC](https://www.ruby-forum.com/t/authenticity-token-change-under-2-2-2/154692/2 "2008-12-03T06:13:37Z")

</div>

Well until 2.2.2 text/plain requests weren’t checked at all (this was  
a bug) so it’s entirely possible that your code has been broken from  
day 1. If you look at the logs does it look like the token was sent  
properly?

Fred

Sent from my iPhone

---

<div class="post-metadata">

**Author:** ![sijomo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/87869e/32.png) [@sijomo](https://www.ruby-forum.com/u/sijomo)\
**Post date:** [December 3, 2008, 7:19am UTC](https://www.ruby-forum.com/t/authenticity-token-change-under-2-2-2/154692/3 "2008-12-03T07:19:43Z")

</div>

Hi Fred,

No, the authenticity\_token isn’t getting through at all, and I accept  
that  
the code probably should have never worked as it stands. That said, I  
can’t for the life of me figure out how to get the auth token to be  
submitted correctly using the XMLHttpRequest object. We have the token  
floating around (we use it in other jQuery AJAX calls), but because this  
particular code is being called during unload, we need it to be  
synchronous, and the jQuery async:false doesn’t appear to work.

Thanks  
Simon

On Wed, 03 Dec 2008 14:12:29 +0900, Frederick C.

---

<div class="post-metadata">

**Author:** ![sijomo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/87869e/32.png) [@sijomo](https://www.ruby-forum.com/u/sijomo)\
**Post date:** [December 3, 2008, 12:15pm UTC](https://www.ruby-forum.com/t/authenticity-token-change-under-2-2-2/154692/4 "2008-12-03T12:15:48Z")

</div>

Excellent, works like a charm, thanks for that.

Simon

On Wed, 03 Dec 2008 17:13:50 +0900, Frederick C.

---

<div class="post-metadata">

**Author:** ![sijomo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/87869e/32.png) [@sijomo](https://www.ruby-forum.com/u/sijomo)\
**Post date:** [December 3, 2008, 9:14am UTC](https://www.ruby-forum.com/t/authenticity-token-change-under-2-2-2/154692/5 "2008-12-03T09:14:26Z")

</div>

On Dec 3, 6:18 am, “Simon M.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Hi Fred,
> 
> No, the authenticity\_token isn’t getting through at all, and I accept that  
> the code probably should have never worked as it stands. That said, I  
> can’t for the life of me figure out how to get the auth token to be  
> submitted correctly using the XMLHttpRequest object. We have the token  
> floating around (we use it in other jQuery AJAX calls), but because this  
> particular code is being called during unload, we need it to be  
> synchronous, and the jQuery async:false doesn’t appear to work.

Well (I had to look this up since I never use raw XMLHttpRequest) the  
parameter to send is the body of the request. When rails gets a text/  
plain request it doesn’t parse the the request body for parameters  
(since you’ve told it that it’s just a big text file). So either you  
could make the type not text/plain (ie application/x-www-form-  
urlencoded), and even then you’d want to drop the leading ? in the  
body, or you could append it to the url you are requesting (being just  
a little bit careful that you glue it on with a & or a ? as  
appropriate)

Fred