# Invalid authenticity tokens when using subdomains

**URL:** <https://www.ruby-forum.com/t/invalid-authenticity-tokens-when-using-subdomains/127535>\
**Category:** Rails\
**Created:** [January 30, 2008, 4:59am UTC](https://www.ruby-forum.com/t/invalid-authenticity-tokens-when-using-subdomains/127535 "2008-01-30T04:59:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![chrisolsen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c6cbf5/32.png) [@chrisolsen](https://www.ruby-forum.com/u/chrisolsen)\
**Post date:** [January 30, 2008, 4:59am UTC](https://www.ruby-forum.com/t/invalid-authenticity-tokens-when-using-subdomains/127535/1 "2008-01-30T04:59:10Z")

</div>

Does anyone have experience with using subdomains and rails? The  
example that I used to help me out was from the Advanced Rails Recipes  
book, but I can’t get it working as it should.

I continually get authenticity token errors after logging in. I have  
had this error before, and for whatever reason after I added a\<%=  
token\_tag %\> to the form it worked, but it doesn’t work in this case.

Any clues to why this is happening?

Thanks for the help

---

<div class="post-metadata">

**Author:** ![chrisolsen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c6cbf5/32.png) [@chrisolsen](https://www.ruby-forum.com/u/chrisolsen)\
**Post date:** [January 30, 2008, 5:10am UTC](https://www.ruby-forum.com/t/invalid-authenticity-tokens-when-using-subdomains/127535/2 "2008-01-30T05:10:21Z")

</div>

Don’t forget to include in your forms a hidden field with:  
name: request\_forgery\_protection\_token.to\_s  
value: form\_authenticity\_token

At least that’s what I do when I’m sending custom POST requests.

---

<div class="post-metadata">

**Author:** ![chrisolsen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c6cbf5/32.png) [@chrisolsen](https://www.ruby-forum.com/u/chrisolsen)\
**Post date:** [January 30, 2008, 5:43am UTC](https://www.ruby-forum.com/t/invalid-authenticity-tokens-when-using-subdomains/127535/3 "2008-01-30T05:43:34Z")

</div>

Lobo tuerto Cazador wrote:

> Don’t forget to include in your forms a hidden field with:  
> name: request\_forgery\_protection\_token.to\_s  
> value: form\_authenticity\_token
> 
> At least that’s what I do when I’m sending custom POST requests.

what is the benefit of that in comparison to the authenticity token  
(input name=“authenticity\_token” type=“hidden”  
value="7cd3363a03957d3d4…), which is what is also generated by the  
token\_tag method?

---

<div class="post-metadata">

**Author:** ![chrisolsen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c6cbf5/32.png) [@chrisolsen](https://www.ruby-forum.com/u/chrisolsen)\
**Post date:** [April 20, 2008, 4:36pm UTC](https://www.ruby-forum.com/t/invalid-authenticity-tokens-when-using-subdomains/127535/4 "2008-04-20T16:36:41Z")

</div>

I have the same problem and I´m using account\_location. The token\_tag  
does exactly the same as described above. Don´t really know what the  
difference is. Anybody else experienced this?

On 30 Jan, 14:43, Chris O. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)