# Buggy forgery protection in Rails 2.1?

**URL:** <https://www.ruby-forum.com/t/buggy-forgery-protection-in-rails-2-1/140175>\
**Category:** Rails\
**Created:** [June 11, 2008, 4:04pm UTC](https://www.ruby-forum.com/t/buggy-forgery-protection-in-rails-2-1/140175 "2008-06-11T16:04:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![overclokkato](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/c67d28/32.png) [@overclokkato](https://www.ruby-forum.com/u/overclokkato)\
**Post date:** [June 11, 2008, 4:04pm UTC](https://www.ruby-forum.com/t/buggy-forgery-protection-in-rails-2-1/140175/1 "2008-06-11T16:04:08Z")

</div>

Hello,

I’ve just upgraded by app to Rails 2.1 and my log started to be filled  
with ActionController::InvalidAuthenticityToken exceptions.

I have an application with external XML Restful access.  
It seems each time a request comes from a search engine crawler (that  
doesn’t support sessions or cookies), Rails 2.1 raises an error even  
if the documentation says:

> Only HTML/JavaScript requests are checked, so this will not protect your XML API (presumably you’ll have a different authentication scheme there anyway).

Any suggestion?

Here’s the latest part of the backtrace.

“ActionController::InvalidAuthenticityToken”  
/usr/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action\_controller/  
request\_forgery\_protection.rb:86:in `verify_authenticity_token' /usr/lib/ruby/gems/1.8/gems/activesupport-2.1.0/lib/active_support/ callbacks.rb:173:in`send’  
/usr/lib/ruby/gems/1.8/gems/activesupport-2.1.0/lib/active\_support/  
callbacks.rb:173:in `evaluate_method' /usr/lib/ruby/gems/1.8/gems/activesupport-2.1.0/lib/active_support/ callbacks.rb:161:in`call’  
/usr/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action\_controller/  
filters.rb:430:in `call' /usr/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action_controller/ filters.rb:592:in`run\_before\_filters’  
/usr/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action\_controller/  
filters.rb:578:in `call_filters' /usr/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action_controller/ filters.rb:573:in`perform\_action\_without\_benchmark’  
/usr/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action\_controller/  
benchmarking.rb:68:in `perform_action_without_rescue' /usr/lib/ruby/1.8/benchmark.rb:293:in`measure’  
/usr/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action\_controller/  
benchmarking.rb:68:in `perform_action_without_rescue' /usr/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action_controller/ rescue.rb:201:in`perform\_action\_without\_caching’  
/usr/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action\_controller/  
caching/sql\_cache.rb:13:in `perform_action' /usr/lib/ruby/gems/1.8/gems/activerecord-2.1.0/lib/active_record/ connection_adapters/abstract/query_cache.rb:33:in`cache’  
/usr/lib/ruby/gems/1.8/gems/activerecord-2.1.0/lib/active\_record/  
query\_cache.rb:8:in `cache' /usr/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action_controller/ caching/sql_cache.rb:12:in`perform\_action’  
/usr/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action\_controller/  
base.rb:529:in `send' /usr/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action_controller/ base.rb:529:in`process\_without\_filters’  
/usr/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action\_controller/  
filters.rb:569:in `process_without_session_management_support' /usr/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action_controller/ session_management.rb:130:in`process’  
/usr/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action\_controller/  
base.rb:389:in `process' /usr/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action_controller/ dispatcher.rb:149:in`handle\_request’  
/usr/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action\_controller/  
dispatcher.rb:107:in `dispatch' /usr/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action_controller/ dispatcher.rb:104:in`synchronize’  
/usr/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action\_controller/  
dispatcher.rb:104:in `dispatch' /usr/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action_controller/ dispatcher.rb:120:in`dispatch\_cgi’  
/usr/lib/ruby/gems/1.8/gems/actionpack-2.1.0/lib/action\_controller/  
dispatcher.rb:35:in `dispatch’

---

<div class="post-metadata">

**Author:** ![overclokkato](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/c67d28/32.png) [@overclokkato](https://www.ruby-forum.com/u/overclokkato)\
**Post date:** [June 11, 2008, 4:10pm UTC](https://www.ruby-forum.com/t/buggy-forgery-protection-in-rails-2-1/140175/2 "2008-06-11T16:10:02Z")

</div>

On 11 Jun 2008, at 15:03, Simone C. wrote:

> > Only HTML/JavaScript requests are checked, so this will not protect  
> > your XML API (presumably you’ll have a different authentication  
> > scheme there anyway).
> 
> Any suggestion?

I do know that it changed from looking at the accept header to the  
content type header  
([Change the request forgery protection to go by Content-Type instead o… · rails/rails@0697d17 · GitHub](http://github.com/rails/rails/commit/0697d17d121fcf9f46b5dd2dd1034dffa19ebdf2)  
)

Fred

---

<div class="post-metadata">

**Author:** ![overclokkato](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/c67d28/32.png) [@overclokkato](https://www.ruby-forum.com/u/overclokkato)\
**Post date:** [June 11, 2008, 4:40pm UTC](https://www.ruby-forum.com/t/buggy-forgery-protection-in-rails-2-1/140175/3 "2008-06-11T16:40:49Z")

</div>

You’re right!

I’ve just discovered two additional interesting discussions about this  
topic.

[http://www.manning-sandbox.com/thread.jspa?threadID=24847&tstart=0](http://www.manning-sandbox.com/thread.jspa?threadID=24847&tstart=0)  
[http://www.mail-archive.com/removed\_email\_address@domain.invalid/msg01985.html](http://www.mail-archive.com/removed_email_address@domain.invalid/msg01985.html)

I think this change is going to break many existing API client using  
www-form-encoded Content-Type!

Thanks,  
Simone

On Jun 11, 4:09 pm, Frederick C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)