# Authenticity token lying around

**URL:** <https://www.ruby-forum.com/t/authenticity-token-lying-around/133613>\
**Category:** Rails\
**Created:** [April 2, 2008, 12:51am UTC](https://www.ruby-forum.com/t/authenticity-token-lying-around/133613 "2008-04-02T00:51:23Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dewie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ac8455/32.png) [@dewie](https://www.ruby-forum.com/u/dewie)\
**Post date:** [April 2, 2008, 12:51am UTC](https://www.ruby-forum.com/t/authenticity-token-lying-around/133613/1 "2008-04-02T00:51:23Z")

</div>

I’ve attached an Ajax POST request to a link. The request is failing  
(InvalidAuthenticityToken) because I’m not sending the authenticity  
token with it.

Searching the forums led me to these two methods…

request\_forgery\_protection\_token

… and…

form\_authenticity\_token

Which I can use to generate the necessary information on my HTML pages.  
However, because I am not building a complete form for this request, I  
thought I would place the information into an arbitrary input field, but  
I’m not sure where.

For the sake of being practical and consistent, I thought the footer a  
good place. Example…

Copyright...

With that in place I can reference it via JavaScript as needed.

I don’t think having the authenticity token on _every_ page is less  
secure than having it on _some_ pages.

Does anyone feel differently?

---

<div class="post-metadata">

**Author:** ![dewie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ac8455/32.png) [@dewie](https://www.ruby-forum.com/u/dewie)\
**Post date:** [April 2, 2008, 4:19pm UTC](https://www.ruby-forum.com/t/authenticity-token-lying-around/133613/2 "2008-04-02T16:19:00Z")

</div>

How are you creating the ajax request. Helpers like link\_to\_remote  
should already include the authenticity token. Similarly you can use  
remote\_function if you need to mix it into other js and that helper  
gives you the authenticity token as well.

On Apr 1, 6:51 pm, Daniel W. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![dewie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ac8455/32.png) [@dewie](https://www.ruby-forum.com/u/dewie)\
**Post date:** [April 2, 2008, 11:38pm UTC](https://www.ruby-forum.com/t/authenticity-token-lying-around/133613/3 "2008-04-02T23:38:27Z")

</div>

AndyV wrote:

> How are you creating the ajax request.

With jQuery.

> Helpers like link\_to\_remote  
> should already include the authenticity token. Similarly you can use  
> remote\_function if you need to mix it into other js and that helper  
> gives you the authenticity token as well.

True, they do, but I don’t want to mix JavaScript into my HTML – even  
if it’s only visible once the page is rendered (i.e. view source).

I also prefer to keep my JavaScript in .js files.

Thanks for the suggestions though. I’ve gone ahead and done as I  
described above: put the authenticity token into a hidden field in my  
footer. It works as expected and I don’t foresee any issues.

---

<div class="post-metadata">

**Author:** ![dewie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ac8455/32.png) [@dewie](https://www.ruby-forum.com/u/dewie)\
**Post date:** [April 2, 2008, 11:52pm UTC](https://www.ruby-forum.com/t/authenticity-token-lying-around/133613/4 "2008-04-02T23:52:27Z")

</div>

On Wed, Apr 2, 2008 at 2:38 PM, Daniel W.  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> > gives you the authenticity token as well.
> 
> True, they do, but I don’t want to mix JavaScript into my HTML – even  
> if it’s only visible once the page is rendered (i.e. view source).
> 
> I also prefer to keep my JavaScript in .js files.
> 
> Thanks for the suggestions though. I’ve gone ahead and done as I  
> described above: put the authenticity token into a hidden field in my  
> footer. It works as expected and I don’t foresee any issues.

You could also set something like window.authenticityToken = ‘\<%=  
form\_authenticity\_token %\>’;

Having it in every page is not a problem. The token is based on your  
session id and is unique for everyone. It doesn’t replace  
authentication in anyway.

–  
Rick O.  
[http://lighthouseapp.com](http://lighthouseapp.com)  
[http://weblog.techno-weenie.net](http://weblog.techno-weenie.net)  
[http://mephistoblog.com](http://mephistoblog.com)

---

<div class="post-metadata">

**Author:** ![dewie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ac8455/32.png) [@dewie](https://www.ruby-forum.com/u/dewie)\
**Post date:** [April 3, 2008, 12:48am UTC](https://www.ruby-forum.com/t/authenticity-token-lying-around/133613/5 "2008-04-03T00:48:08Z")

</div>

Rick O. wrote:

> You could also set something like window.authenticityToken = ‘\<%=  
> form\_authenticity\_token %\>’;
> 
> Having it in every page is not a problem. The token is based on your  
> session id and is unique for everyone. It doesn’t replace  
> authentication in anyway.

Ah, I like that! Setting it in JavaScript makes even _more_ sense!

Good one, Rick. Thanks.