# Invalid Authenticity Token after redirect

**URL:** <https://www.ruby-forum.com/t/invalid-authenticity-token-after-redirect/133748>\
**Category:** Rails\
**Created:** [April 3, 2008, 8:08am UTC](https://www.ruby-forum.com/t/invalid-authenticity-token-after-redirect/133748 "2008-04-03T08:08:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![tonypm](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/a587f6/32.png) [@tonypm](https://www.ruby-forum.com/u/tonypm)\
**Post date:** [April 3, 2008, 8:08am UTC](https://www.ruby-forum.com/t/invalid-authenticity-token-after-redirect/133748/1 "2008-04-03T08:08:16Z")

</div>

I have a simple login controller in which I use new/create to do the  
login. For create, I have

def create # do login  
session[:user\_id] = nil  
u=params[:user]  
user = User.authenticate(u[:name], u[:password])  
if user  
session[:user\_id] = user.id  
flash[:info]= ‘Login Successful’  
redirect\_to(:action =\> “index”, :controller=\>‘main’ )  
else  
flash[:notice] = “Login Failure”  
redirect\_to new\_login\_path  
end

When I get a login failure, the redirect correctly takes me to the  
login screen (new), but when I submit the form I get  
ActionController::InvalidAuthenticityToken

There is another thread  
[http://groups.google.com/group/rubyonrails-talk/browse\_thread/thread/cba205f4e3153d5a](http://groups.google.com/group/rubyonrails-talk/browse_thread/thread/cba205f4e3153d5a)  
that suggested \<%= token\_tag %\>.

I tried that it my form, but no joy. Can’t really find much in the  
way of docs, couldn’t even find token\_tag. I know there is mention  
of a bug fix which is coming, does anyone know if that is going to  
solve this one, or is there some way of working round it other than  
disabling protect from forgery

Tony

---

<div class="post-metadata">

**Author:** ![tonypm](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/a587f6/32.png) [@tonypm](https://www.ruby-forum.com/u/tonypm)\
**Post date:** [April 3, 2008, 8:30am UTC](https://www.ruby-forum.com/t/invalid-authenticity-token-after-redirect/133748/2 "2008-04-03T08:30:00Z")

</div>

OK, looking at this a bit more, I can see in the forms that I am  
getting a different authenticity token in the form generated by  
submitting the url - localhost:3000/login to the one in the form  
generated after the redirect.

Now watching the server output, I can see that I am getting a  
different Session ID:  
The first part is the same, but the last part is very different

Tony

---

<div class="post-metadata">

**Author:** ![tonypm](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/a587f6/32.png) [@tonypm](https://www.ruby-forum.com/u/tonypm)\
**Post date:** [April 3, 2008, 9:26am UTC](https://www.ruby-forum.com/t/invalid-authenticity-token-after-redirect/133748/3 "2008-04-03T09:26:52Z")

</div>

You have the secret cookie set, I’m guessing, which means that in  
forms, you need to get rails to generate the forms, otherwise they  
won’t have the hidden authenticity field in the form.

What does your view file look like for users/new.rhtml.erb? Is it  
using Rails helpers for the form tag?

Julian.

Learn Ruby on Rails! CHECK OUT THE FREE VIDS (LIMITED TIME) NEW VIDEO  
(#2) OUT NOW!  
[http://sensei.zenunit.com/](http://sensei.zenunit.com/)

---

<div class="post-metadata">

**Author:** ![tonypm](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/a587f6/32.png) [@tonypm](https://www.ruby-forum.com/u/tonypm)\
**Post date:** [April 3, 2008, 9:34am UTC](https://www.ruby-forum.com/t/invalid-authenticity-token-after-redirect/133748/4 "2008-04-03T09:34:33Z")

</div>

By resetting the session, you’re indubitably resetting the  
authenticity token.

Julian.

Learn Ruby on Rails! CHECK OUT THE FREE VIDS (LIMITED TIME) NEW VIDEO  
(#2) OUT NOW!  
[http://sensei.zenunit.com/](http://sensei.zenunit.com/)