# Collection\_select ajax.Updater InvalidAuthenticityToken

**URL:** <https://www.ruby-forum.com/t/collection-select-ajax-updater-invalidauthenticitytoken/124761>\
**Category:** Rails\
**Created:** [January 2, 2008, 11:12am UTC](https://www.ruby-forum.com/t/collection-select-ajax-updater-invalidauthenticitytoken/124761 "2008-01-02T11:12:04Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![hiddenhippo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/65b543/32.png) [@hiddenhippo](https://www.ruby-forum.com/u/hiddenhippo)\
**Post date:** [January 2, 2008, 11:12am UTC](https://www.ruby-forum.com/t/collection-select-ajax-updater-invalidauthenticitytoken/124761/1 "2008-01-02T11:12:04Z")

</div>

Hi,

I’m currently using the latest version of rails 2.0.2 with cookies.  
My problem is as follows, to which I’ve not found any help on google  
etc.

I have a page which presents the user with two drop-down menus. The  
first one, for example, asks for a car manufacurer, and the second,  
which by default is blank, will ask for the model. Within my view I  
use the following

\<%= collection\_select(:manufacturer, :manufacturer\_id,  
@manufacturers, :id, :description, options ={:prompt =\> “-Select a  
Manufacturer”},  
{  
:onChange =\> “new Ajax.Updater(‘manufacturer\_model\_id’, ‘/  
models/list\_by\_manufacturer\_id/’+ this[this.selectedIndex].value,  
{asynchronous:true, evalScripts:true})”  
}  
) %\>

\<%= collection\_select(:manufacturer, :model\_id,  
@models, :id, :description, options ={:prompt =\> “-Select a model”})%\>

The above works fine. When I choose a manufacturer from the first  
selection it fires the js but rails then returns an error:

ActionController::InvalidAuthenticityToken  
in ModelController#list\_by\_manufacturer\_id

I believe the problem might be because I need to pass the  
authenticity\_token as part of the request, though I’m not sure, and if  
so I’m uncertain as to how I go about passing it within the ajax call.

Any help/direction would be greatly appreciated

---

<div class="post-metadata">

**Author:** ![hiddenhippo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/65b543/32.png) [@hiddenhippo](https://www.ruby-forum.com/u/hiddenhippo)\
**Post date:** [January 2, 2008, 12:00pm UTC](https://www.ruby-forum.com/t/collection-select-ajax-updater-invalidauthenticitytoken/124761/2 "2008-01-02T12:00:05Z")

</div>

seems i might be getting a little closer with the following code

\<%= collection\_select(:manufacturer, :manufacturer\_id,  
@manufacturers, :id, :description, options ={:prompt =\> “-Select a  
Manufacturer”},  
{  
:onChange =\>  
link\_to\_remote("",:update=\>"manufacturer\_model\_id’,:url=\>{:controller=\>:models,  
:action=\>:list\_by\_manufacturer\_id})  
}

```
     ) %>

```

This seems to create the HTML etc correctly with the  
authenticity\_token, but when I click on the select list nothing is  
every fired - no ajax call is ever made.

Any ideas?

---

<div class="post-metadata">

**Author:** ![hiddenhippo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/65b543/32.png) [@hiddenhippo](https://www.ruby-forum.com/u/hiddenhippo)\
**Post date:** [January 2, 2008, 12:23pm UTC](https://www.ruby-forum.com/t/collection-select-ajax-updater-invalidauthenticitytoken/124761/3 "2008-01-02T12:23:28Z")

</div>

dispite hoping to use link\_to\_remote I’ve ended up manually typing the  
following;

\<%= collection\_select(:manufacturer, :manufacturer\_id,  
@manufacturers, :id, :description, options ={:prompt =\> “-Select a  
Manufacturer”},  
{  
:onChange =\>  
“new Ajax.Updater  
(‘member\_id\_selection’,  
‘/models/list\_by\_manufacturer\_id/’+  
this[this.selectedIndex].value,  
{asynchronous:true, evalScripts:true,  
parameters:‘authenticity\_token=’+  
encodeURIComponent(’”+form\_authenticity\_token.to\_s+"’)}  
)"  
) %\>

This actually works but seems but surely the helper method should have  
worked. Does anyone knoe whether I could redo this in a far cleaner  
way, i.e. using a helper?

thanks

---

<div class="post-metadata">

**Author:** ![hiddenhippo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/65b543/32.png) [@hiddenhippo](https://www.ruby-forum.com/u/hiddenhippo)\
**Post date:** [January 2, 2008, 2:10pm UTC](https://www.ruby-forum.com/t/collection-select-ajax-updater-invalidauthenticitytoken/124761/4 "2008-01-02T14:10:15Z")

</div>

thanks, that actually worked. I knew i must have been missing  
something.

thanks again

On Jan 2, 11:25 am, Frederick C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![hiddenhippo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/65b543/32.png) [@hiddenhippo](https://www.ruby-forum.com/u/hiddenhippo)\
**Post date:** [January 2, 2008, 12:26pm UTC](https://www.ruby-forum.com/t/collection-select-ajax-updater-invalidauthenticitytoken/124761/5 "2008-01-02T12:26:25Z")

</div>

On 2 Jan 2008, at 10:59, hiddenhippo wrote:

> ("",:update  
> This seems to create the HTML etc correctly with the  
> authenticity\_token, but when I click on the select list nothing is  
> every fired - no ajax call is ever made.

link\_to\_remote actually creates an with an onclick that does the  
ajaxy stuff. In this sort of situation you want to use remote\_function  
(takes basically the same arguments as link\_to\_remote, barring of  
course the first one)

Fred

---

<div class="post-metadata">

**Author:** ![hiddenhippo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/65b543/32.png) [@hiddenhippo](https://www.ruby-forum.com/u/hiddenhippo)\
**Post date:** [May 13, 2008, 4:45pm UTC](https://www.ruby-forum.com/t/collection-select-ajax-updater-invalidauthenticitytoken/124761/6 "2008-05-13T16:45:33Z")

</div>

The code in question would lie in the view rather than the  
controller. Stealing blindly from what was posted above:

\<%= collection\_select(:manufacturer, :manufacturer\_id,  
@manufacturers, :id, :description,  
{:prompt =\> “-Select a Manufacturer”},  
{ :onChange =\>  
remote\_function(:url=\>…, :method=\>…, :with=\>“manufacturer\_id”)}  
) %\>

On May 13, 5:43 am, William Notowidagdo \<rails-mailing-l…@andreas-

---

<div class="post-metadata">

**Author:** ![hiddenhippo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/65b543/32.png) [@hiddenhippo](https://www.ruby-forum.com/u/hiddenhippo)\
**Post date:** [May 13, 2008, 11:43am UTC](https://www.ruby-forum.com/t/collection-select-ajax-updater-invalidauthenticitytoken/124761/7 "2008-05-13T11:43:57Z")

</div>

hiddenhippo wrote:

> thanks, that actually worked. I knew i must have been missing  
> something.
> 
> thanks again

can you show me your controller? i have the same problem too.

thanks

–william

---

<div class="post-metadata">

**Author:** ![hiddenhippo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/65b543/32.png) [@hiddenhippo](https://www.ruby-forum.com/u/hiddenhippo)\
**Post date:** [May 14, 2008, 3:50am UTC](https://www.ruby-forum.com/t/collection-select-ajax-updater-invalidauthenticitytoken/124761/8 "2008-05-14T03:50:11Z")

</div>

thank you all. my problem is done