# Getting InvalidAuthenticityToken errors quite often

**URL:** <https://www.ruby-forum.com/t/getting-invalidauthenticitytoken-errors-quite-often/138415>\
**Category:** Rails\
**Created:** [May 22, 2008, 8:03pm UTC](https://www.ruby-forum.com/t/getting-invalidauthenticitytoken-errors-quite-often/138415 "2008-05-22T20:03:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![chrisolsen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c6cbf5/32.png) [@chrisolsen](https://www.ruby-forum.com/u/chrisolsen)\
**Post date:** [May 22, 2008, 8:03pm UTC](https://www.ruby-forum.com/t/getting-invalidauthenticitytoken-errors-quite-often/138415/1 "2008-05-22T20:03:04Z")

</div>

How often is the authenticity token updated?

The latest error that I got was a submittal of a form, an model  
validation occured, I click back, make the correction, resubmit the  
form, then I get an InvalidAuthenticityToken error.

Somewhat off topic  
If a person is using the authenticity tokens is there still a need to  
use some sort of captcha?

Thanks

---

<div class="post-metadata">

**Author:** ![chrisolsen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c6cbf5/32.png) [@chrisolsen](https://www.ruby-forum.com/u/chrisolsen)\
**Post date:** [May 22, 2008, 8:12pm UTC](https://www.ruby-forum.com/t/getting-invalidauthenticitytoken-errors-quite-often/138415/2 "2008-05-22T20:12:35Z")

</div>

On 22 May 2008, at 19:03, Chris O. wrote:

> How often is the authenticity token updated?
> 
> The latest error that I got was a submittal of a form, an model  
> validation occured, I click back, make the correction, resubmit the  
> form, then I get an InvalidAuthenticityToken error.

They are tied to the session id (non cookie store) or from the crsf\_id  
in the session (cookie store). if something is killing the session  
that will do it

> Somewhat off topic  
> If a person is using the authenticity tokens is there still a need to  
> use some sort of captcha?

captcha and authenticity tokens are for completely different things.  
Authenticity tokens are for guarding against crsf attacks, captchas  
are for preventing computer programs automatically doing stuff with  
your web app.

Fred

---

<div class="post-metadata">

**Author:** ![chrisolsen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c6cbf5/32.png) [@chrisolsen](https://www.ruby-forum.com/u/chrisolsen)\
**Post date:** [June 24, 2008, 3:12am UTC](https://www.ruby-forum.com/t/getting-invalidauthenticitytoken-errors-quite-often/138415/3 "2008-06-24T03:12:24Z")

</div>

Hi,

I’m also getting InvalidAuthenticityToken errors. Usually this happens  
after some time. I was doing the usual gets and posts, then after some  
time I’ll get an InvalidAuthenticityToken error. My logs showed that  
the tokens are exactly the same. Does this mean that the authenticity  
token is tied to the sessions? When the session ends, the authenticity  
token needs to be renewed?

Zan

On May 23, 2:09 am, Frederick C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)