# Functional testing with form\_authenticity\_token

**URL:** <https://www.ruby-forum.com/t/functional-testing-with-form-authenticity-token/130518>\
**Category:** Rails\
**Created:** [February 28, 2008, 11:21pm UTC](https://www.ruby-forum.com/t/functional-testing-with-form-authenticity-token/130518 "2008-02-28T23:21:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![greg](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/71c47a/32.png) [@greg](https://www.ruby-forum.com/u/greg)\
**Post date:** [February 28, 2008, 11:21pm UTC](https://www.ruby-forum.com/t/functional-testing-with-form-authenticity-token/130518/1 "2008-02-28T23:21:58Z")

</div>

hello,

I am building a page that has many ajax calls on the page, so when I  
moved to rails 2.0, I, of course, noticed that my ajax calls stopped  
working. After some research, I came up with the following solution.

I create a

\<%= form\_authenticity\_token  
%\>
 at the bottom of my document, so that I could easily grab the  
value with javascript and include it in my ajax calls This worked  
great, btw.

The problem comes when I am trying to write functional tests for the  
these pages. For example, the following code:

def test\_view\_not\_logged\_in  
get :view, :id =\> users(:quentin).id  
assert\_response :success  
end

Creates the following error:

ActionView::TemplateError: No :secret given to the  
#protect\_from\_forgery call. Set that or use a session store capable  
of generating its own keys (Cookie Session Store).  
On line #39 of account/\_signup\_form.rhtml

```
36: </div>
37: <a href="javascript:showNewImage()">Try a different image </

```

a\>  
38: \<% end -%\>  
39:

\<%=  
form\_authenticity\_token %\>

I am using the Cookie Session Store in my development and production  
environements. Is there any difference in the test environment? I  
could add the :secret when I do testing, but that is pretty  
cumbersome.

thanks in advance for any help!

Greg

---

<div class="post-metadata">

**Author:** ![greg](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/71c47a/32.png) [@greg](https://www.ruby-forum.com/u/greg)\
**Post date:** [May 23, 2008, 7:10pm UTC](https://www.ruby-forum.com/t/functional-testing-with-form-authenticity-token/130518/2 "2008-05-23T19:10:51Z")

</div>

Hi,

Unfortunately I also came into this bug so I created a patch and  
submitted it to lighthouse:  
[http://rails.lighthouseapp.com/projects/8994-ruby-on-rails/tickets/242-patch-fixing-form\_authenticity\_token-in-the-test-environment](http://rails.lighthouseapp.com/projects/8994-ruby-on-rails/tickets/242-patch-fixing-form_authenticity_token-in-the-test-environment)

It doesn’t merge correctly into 2.0.1, only edge.

Tiago M.

---

<div class="post-metadata">

**Author:** ![greg](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/71c47a/32.png) [@greg](https://www.ruby-forum.com/u/greg)\
**Post date:** [February 28, 2008, 11:37pm UTC](https://www.ruby-forum.com/t/functional-testing-with-form-authenticity-token/130518/3 "2008-02-28T23:37:15Z")

</div>

Following up on my own post…

I guess that I need to make sure that forgery is turned on:

\<% if protect\_against\_forgery? %\>

\<%= form\_authenticity\_token %\>
\<% end %\>

The test environment turns it off.