# Form Authenticity Token Error generated from iframe

**URL:** <https://www.ruby-forum.com/t/form-authenticity-token-error-generated-from-iframe/186220>\
**Category:** Rails\
**Created:** [April 2, 2010, 12:42pm UTC](https://www.ruby-forum.com/t/form-authenticity-token-error-generated-from-iframe/186220 "2010-04-02T12:42:58Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![nisha](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/76d3ee/32.png) [@nisha](https://www.ruby-forum.com/u/nisha)\
**Post date:** [April 2, 2010, 12:42pm UTC](https://www.ruby-forum.com/t/form-authenticity-token-error-generated-from-iframe/186220/1 "2010-04-02T12:42:58Z")

</div>

Hi,

Iam trying to link my app from another site. I have used iframes and a  
form is being loaded in the iframe embeded in another site outside my  
rails app. So when the user submits this form it should effectively  
take me to the application site with the post data… iam getting  
authenticity token error while doing this… can anyone guide me how to  
achieve the objective…

thnks

Nisha

---

<div class="post-metadata">

**Author:** ![nisha](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/76d3ee/32.png) [@nisha](https://www.ruby-forum.com/u/nisha)\
**Post date:** [April 7, 2010, 8:55am UTC](https://www.ruby-forum.com/t/form-authenticity-token-error-generated-from-iframe/186220/2 "2010-04-07T08:55:39Z")

</div>

Actually iam well perplexed with the situation… The form that iam  
embedding in another site, when submitted, the POST action does not  
actually store or retrieve anything from the database… It just  
manipulates the form param data, that is submitted by POST, to get  
the next page… So with this as the situation is it safe to disable  
forgery protection for that POST action and continue ??? Will this  
make it XSS vulnerable ??? Pls guide me on this… Expert advice and  
comments are most needed to guide me towards the right direction…