# Autocomplete plugin with Rails 2.0

**URL:** <https://www.ruby-forum.com/t/autocomplete-plugin-with-rails-2-0/118004>\
**Category:** Rails\
**Created:** [October 23, 2007, 10:47am UTC](https://www.ruby-forum.com/t/autocomplete-plugin-with-rails-2-0/118004 "2007-10-23T10:47:38Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![bparanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e9a140/32.png) [@bparanj](https://www.ruby-forum.com/u/bparanj)\
**Post date:** [October 23, 2007, 10:47am UTC](https://www.ruby-forum.com/t/autocomplete-plugin-with-rails-2-0/118004/1 "2007-10-23T10:47:38Z")

</div>

I installed the auto\_complete plugin found at  
[http://svn.rubyonrails.org/rails/plugins/auto\_complete](http://svn.rubyonrails.org/rails/plugins/auto_complete). When I type a  
character in the autocomplete field I get the following error:

Processing EventsController#auto\_complete\_for\_event\_location (for  
127.0.0.1at 2007-10-22 22:54:24) [POST]  
Session ID:  
BAh7BzoMY3NyZl9pZCIlMmE3MzI5MDU4NWVjNTRjMTk1ODBjMWRiYTgzNzIz%0AYWQiCmZsYXNoSUM6J0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhh%0Ac2h7AAY6CkB1c2VkewA%3D–4397ccb385b2d851c2d39ad5e79fc587433843fc  
Parameters: {“event”=\>{“location”=\>“m”},  
“action”=\>“auto\_complete\_for\_event\_location”,  
“controller”=\>“admin/events”}

ActionController::InvalidAuthenticityToken  
(ActionController::InvalidAuthenticityToken):  
/usr/local/lib/ruby/gems/1.8/gems/actionpack-1.13.3.7707/lib/action\_controller/request\_forgery\_protection.rb:73:in  
`verify_authenticity_token' /usr/local/lib/ruby/gems/1.8/gems/actionpack-1.13.3.7707/lib/action_controller/filters.rb:469:in `send’  
/usr/local/lib/ruby/gems/1.8/gems/actionpack-1.13.3.7707/lib/action\_controller/filters.rb:469:in  
`call' /usr/local/lib/ruby/gems/1.8/gems/actionpack-1.13.3.7707/lib/action_controller/filters.rb:442:in `run’  
/usr/local/lib/ruby/gems/1.8/gems/actionpack-1.13.3.7707/lib/action\_controller/filters.rb:713:in  
`run\_before\_filters’  
/usr/local/lib/ruby/

I changed the routes to include the auto\_complete\_for\_event\_location as  
a  
collection.

map.namespace(:admin) do |admin|  
admin.resources :events,  
:collection =\> { :load =\> :get },  
:collection =\> { :auto\_complete\_for\_event\_location =\> :get}  
end

The controller is protected by http authentication. Any ideas on why  
this is  
failing? TIA.

---

<div class="post-metadata">

**Author:** ![bparanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e9a140/32.png) [@bparanj](https://www.ruby-forum.com/u/bparanj)\
**Post date:** [October 23, 2007, 12:16pm UTC](https://www.ruby-forum.com/t/autocomplete-plugin-with-rails-2-0/118004/2 "2007-10-23T12:16:50Z")

</div>

On 23 Oct 2007, at 07:00, Bala P. wrote:

> Parameters: {“event”=\>{“location”=\>“m”},  
> action\_controller/filters.rb:469:in `send’

It’s the crsf protection. You either need to get the autocomplete to  
include the token, or make it use a get request instead of a post.

Fred

---

<div class="post-metadata">

**Author:** ![bparanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e9a140/32.png) [@bparanj](https://www.ruby-forum.com/u/bparanj)\
**Post date:** [October 23, 2007, 12:19pm UTC](https://www.ruby-forum.com/t/autocomplete-plugin-with-rails-2-0/118004/3 "2007-10-23T12:19:10Z")

</div>

Oh and of course you can turn of forgery protection for a controller/  
action with protect\_from\_forgery, eg  
protect\_from\_forgery :only =\> [:foo, :bar] (see [http://ryandaigle.com/](http://ryandaigle.com/)  
articles/2007/9/24/what-s-new-in-edge-rails-better-cross-site-request-  
forging-prevention)

Fred

---

<div class="post-metadata">

**Author:** ![bparanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e9a140/32.png) [@bparanj](https://www.ruby-forum.com/u/bparanj)\
**Post date:** [November 22, 2007, 5:54am UTC](https://www.ruby-forum.com/t/autocomplete-plugin-with-rails-2-0/118004/4 "2007-11-22T05:54:51Z")

</div>

I tried out adding the exclude line:

```
protect_from_forgery :only => [:tag]

```

However, it seems ugly that I have to add each method manually. I  
tried

```
protect_from_forgery :exclude => [:auto_complete_for_tag_name]

```

but that didn’t work. Is this oddness a) a bug or b) just something  
the docs for the plugin should discuss?

---

<div class="post-metadata">

**Author:** ![bparanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e9a140/32.png) [@bparanj](https://www.ruby-forum.com/u/bparanj)\
**Post date:** [December 13, 2007, 2:32pm UTC](https://www.ruby-forum.com/t/autocomplete-plugin-with-rails-2-0/118004/5 "2007-12-13T14:32:00Z")

</div>

How can you manually set the token generated by Rails?

This is because I want to use this security feature, but I want to  
craft my own forms, or I need to make some POST requests and I need to  
set the token manually in the client :S

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![bparanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e9a140/32.png) [@bparanj](https://www.ruby-forum.com/u/bparanj)\
**Post date:** [November 9, 2007, 5:56pm UTC](https://www.ruby-forum.com/t/autocomplete-plugin-with-rails-2-0/118004/6 "2007-11-09T17:56:27Z")

</div>

I have the same error, how do I disable this feature?

---

<div class="post-metadata">

**Author:** ![bparanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e9a140/32.png) [@bparanj](https://www.ruby-forum.com/u/bparanj)\
**Post date:** [December 13, 2007, 2:51pm UTC](https://www.ruby-forum.com/t/autocomplete-plugin-with-rails-2-0/118004/7 "2007-12-13T14:51:24Z")

</div>

On 13 Dec 2007, at 13:31, Adrián De la Cruz wrote:

> How can you manually set the token generated by Rails?

I don’t think you can, but you can get its value  
The helpful snippet is this bit of code from the rails view helpers:

def token\_tag  
unless protect\_against\_forgery?  
‘’  
else  
tag(:input, :type =\> “hidden”, :name =\>  
request\_forgery\_protection\_token.to\_s, :value =\>  
form\_authenticity\_token)  
end  
end

Fred

---

<div class="post-metadata">

**Author:** ![bparanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e9a140/32.png) [@bparanj](https://www.ruby-forum.com/u/bparanj)\
**Post date:** [January 10, 2008, 2:18pm UTC](https://www.ruby-forum.com/t/autocomplete-plugin-with-rails-2-0/118004/8 "2008-01-10T14:18:02Z")

</div>

Hi,  
I’ve encountered the same problem and wasted hours on it (i’m new to  
rails…)

I tinkered a bit with the auto\_complete plug-in source, adding the  
authenticity token to the parameteres sent by auto\_complete\_field in the  
same way that  
prototype\_helper does it.  
Here’s a partial source of the updated method in the file:  
\vendor\plugins\auto\_complete\lib\auto\_complete\_macros\_helper.rb.  
The updated file is attached

def auto\_complete\_field(field\_id, options = {})

```
... skip to about line 75:
js_options[v] = options[k] if options[k]
end

# MY CHANGE - add the authenticity token with exactly the same code
# from the prototype_helper:
if protect_against_forgery?
      if js_options['parameters']
        js_options['parameters'] << " + '&"
      else
        js_options['parameters'] = "'"
      end
      js_options['parameters'] << 

```

“#{request\_forgery\_protection\_token}=’ +  
encodeURIComponent(’#{escape\_javascript form\_authenticity\_token}’)”  
end  
# END MY CHANGE

```
function << (', ' + options_for_javascript(js_options) + ')')

javascript_tag(function)

```

end

---

<div class="post-metadata">

**Author:** ![bparanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e9a140/32.png) [@bparanj](https://www.ruby-forum.com/u/bparanj)\
**Post date:** [September 6, 2008, 8:52am UTC](https://www.ruby-forum.com/t/autocomplete-plugin-with-rails-2-0/118004/9 "2008-09-06T08:52:38Z")

</div>

Bala P. wrote:

> I installed the auto\_complete plugin found at  
> [http://svn.rubyonrails.org/rails/plugins/auto\_complete](http://svn.rubyonrails.org/rails/plugins/auto_complete). When I type a  
> character in the autocomplete field I get the following error:
> 
> Processing EventsController#auto\_complete\_for\_event\_location (for  
> 127.0.0.1at 2007-10-22 22:54:24) [POST]  
> Session ID:  
> BAh7BzoMY3NyZl9pZCIlMmE3MzI5MDU4NWVjNTRjMTk1ODBjMWRiYTgzNzIz%0AYWQiCmZsYXNoSUM6J0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhh%0Ac2h7AAY6CkB1c2VkewA%3D–4397ccb385b2d851c2d39ad5e79fc587433843fc  
> Parameters: {“event”=\>{“location”=\>“m”},  
> “action”=\>“auto\_complete\_for\_event\_location”,  
> “controller”=\>“admin/events”}
> 
> ActionController::InvalidAuthenticityToken  
> (ActionController::InvalidAuthenticityToken):  
> /usr/local/lib/ruby/gems/1.8/gems/actionpack-1.13.3.7707/lib/action\_controller/request\_forgery\_protection.rb:73:in  
> `verify_authenticity_token' /usr/local/lib/ruby/gems/1.8/gems/actionpack-1.13.3.7707/lib/action_controller/filters.rb:469:in `send’  
> /usr/local/lib/ruby/gems/1.8/gems/actionpack-1.13.3.7707/lib/action\_controller/filters.rb:469:in  
> `call' /usr/local/lib/ruby/gems/1.8/gems/actionpack-1.13.3.7707/lib/action_controller/filters.rb:442:in `run’  
> /usr/local/lib/ruby/gems/1.8/gems/actionpack-1.13.3.7707/lib/action\_controller/filters.rb:713:in  
> `run\_before\_filters’  
> /usr/local/lib/ruby/
> 
> I changed the routes to include the auto\_complete\_for\_event\_location as  
> a  
> collection.
> 
> map.namespace(:admin) do |admin|  
> admin.resources :events,  
> :collection =\> { :load =\> :get },  
> :collection =\> { :auto\_complete\_for\_event\_location =\> :get}  
> end
> 
> The controller is protected by http authentication. Any ideas on why  
> this is  
> failing? TIA.

Hi!

Can you showme your “routes.rb”?

I have so many problems to configure my routes with namespaces. I have  
the following error:  
Parameters: {“action”=\>“usuarios”, “persona”=\>{“nombre”=\>“Gre”},  
“id”=\>“auto\_complete\_for\_persona\_nombre”, “controller”=\>“admin”}

When my controller is “admin/usuarios”

My routes are:

ActionController::Routing::Routes.draw do |map|  
map.resources :telefonos  
map.resources :direcciones  
map.resources :usuarios  
map.resources :perfiles  
map.resources :personas

map.namespace(:admin) do |admin|  
admin.resources :usuarios,  
:collection =\> { :load =\> :get },  
:collection =\> { :auto\_complete\_for\_persona\_nombre =\> :get}

```
admin.resources :personas,
admin.resources :perfiles

```

end

map.root :controller =\> “sesion”

map.connect ‘:controller/:action/:id’  
map.connect ‘:controller/:action/:id.:format’  
end

---

<div class="post-metadata">

**Author:** ![bparanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e9a140/32.png) [@bparanj](https://www.ruby-forum.com/u/bparanj)\
**Post date:** [February 6, 2009, 3:00pm UTC](https://www.ruby-forum.com/t/autocomplete-plugin-with-rails-2-0/118004/10 "2009-02-06T15:00:03Z")

</div>

Eric P. wrote:

> I tried out adding the exclude line:
> 
> ```
> protect_from_forgery :only => [:tag]
> 
> ```
> 
> However, it seems ugly that I have to add each method manually. I  
> tried
> 
> ```
> protect_from_forgery :exclude => [:auto_complete_for_tag_name]
> 
> ```
> 
> but that didn’t work. Is this oddness a) a bug or b) just something  
> the docs for the plugin should discuss?

use :except instead of :exclude

=\> protect\_from\_forgery :except =\> [:auto\_complete\_for\_tag\_name]

---

<div class="post-metadata">

**Author:** ![bparanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e9a140/32.png) [@bparanj](https://www.ruby-forum.com/u/bparanj)\
**Post date:** [December 13, 2007, 2:56pm UTC](https://www.ruby-forum.com/t/autocomplete-plugin-with-rails-2-0/118004/11 "2007-12-13T14:56:09Z")

</div>

Thanks for taking the time to help us 😉

---

<div class="post-metadata">

**Author:** ![bparanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e9a140/32.png) [@bparanj](https://www.ruby-forum.com/u/bparanj)\
**Post date:** [February 6, 2009, 3:02pm UTC](https://www.ruby-forum.com/t/autocomplete-plugin-with-rails-2-0/118004/12 "2009-02-06T15:02:10Z")

</div>

> use :except instead of :exclude
> 
> =\> protect\_from\_forgery :except =\> [:auto\_complete\_for\_tag\_name]

[http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html#M000493](http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html#M000493)

---

<div class="post-metadata">

**Author:** ![bparanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e9a140/32.png) [@bparanj](https://www.ruby-forum.com/u/bparanj)\
**Post date:** [February 7, 2009, 1:21pm UTC](https://www.ruby-forum.com/t/autocomplete-plugin-with-rails-2-0/118004/13 "2009-02-07T13:21:16Z")

</div>

Tanks Elad Roz

Attachment: auto\_complete\_macros\_helper.rb (7,6 KB)

your attachment it s work perfectly