# CSRF / cached authenticity tokens / ajax requests

**URL:** <https://www.ruby-forum.com/t/csrf-cached-authenticity-tokens-ajax-requests/126978>\
**Category:** Rails\
**Created:** [January 23, 2008, 10:26pm UTC](https://www.ruby-forum.com/t/csrf-cached-authenticity-tokens-ajax-requests/126978 "2008-01-23T22:26:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [January 23, 2008, 10:26pm UTC](https://www.ruby-forum.com/t/csrf-cached-authenticity-tokens-ajax-requests/126978/1 "2008-01-23T22:26:56Z")

</div>

I’m going to go out on a limb here and say the new CSRF protection in  
Rails is flawed. Why? Forget about caching if you care to use it.  
Consider the following:

\<% cache do %\>  
\<%= link\_to\_remote “Add To Favorites”, :url =\> {:controller =\>  
“favorites”, :action =\> “create”, “movie\_id” =\> 2} %\>  
\<% end %\>

# Output

Add To Favorites

The trouble is the cached (and consequently invalid)  
authenticity\_token being sent in the POST, which triggers the CSRF in  
Rails, thereby rejecting the request. That’s no fun.

Then again, maybe I’m an incompetent retard and the CSRF protection in  
Rails is flawless and I’m totally missing something. Please,  
somebody, educate me if this is the case.

Thanks,  
Josh

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [January 24, 2008, 9:39am UTC](https://www.ruby-forum.com/t/csrf-cached-authenticity-tokens-ajax-requests/126978/2 "2008-01-24T09:39:43Z")

</div>

The ‘flaw’ is in the programmer that thinks he can cache dynamic content  
such as…

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [January 25, 2008, 4:10am UTC](https://www.ruby-forum.com/t/csrf-cached-authenticity-tokens-ajax-requests/126978/3 "2008-01-25T04:10:55Z")

</div>

I don’t see your point. Please clarify.

Thanks,  
Josh

On Jan 24, 3:39 am, Keynan P. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)