# InvalidAuthenticityToken error with db sessions

**URL:** <https://www.ruby-forum.com/t/invalidauthenticitytoken-error-with-db-sessions/161320>\
**Category:** Rails\
**Created:** [February 25, 2009, 2:13pm UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-error-with-db-sessions/161320 "2009-02-25T14:13:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sa125](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/b4bc9f/32.png) [@sa125](https://www.ruby-forum.com/u/sa125)\
**Post date:** [February 25, 2009, 2:13pm UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-error-with-db-sessions/161320/1 "2009-02-25T14:13:58Z")

</div>

I added login to my app and storing the sessions in the db. I  
un-commented the “config.action\_controller.session\_store =  
:active\_record\_store” line in the environment.rb file, and the :secret  
in the application.rb file.

Now, when I try to login I get the error InvalidAuthenticityToken.  
Here’s my login form:

\<% form\_for :user, :url =\> { :action =\> ‘do\_login’ } do |f| %\>

user: \<%= f.text\_field :user\_name %\>

pass: \<%= f.password\_field :password %\>

 \<%= f.submit 'login' %\> \<% end %\>

I checked the markup and the hidden field with the token appears. I’m  
baffled on what keep causing this error - and would appreciate any help.

---

<div class="post-metadata">

**Author:** ![sa125](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/b4bc9f/32.png) [@sa125](https://www.ruby-forum.com/u/sa125)\
**Post date:** [February 25, 2009, 2:43pm UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-error-with-db-sessions/161320/2 "2009-02-25T14:43:41Z")

</div>

sa 125 wrote:

> I added login to my app and storing the sessions in the db. I  
> un-commented the “config.action\_controller.session\_store =  
> :active\_record\_store” line in the environment.rb file, and the :secret  
> in the application.rb file.
> 
> Now, when I try to login I get the error InvalidAuthenticityToken.  
> Here’s my login form:
> 
> \<% form\_for :user, :url =\> { :action =\> ‘do\_login’ } do |f| %\>
> 
> user: \<%= f.text\_field :user\_name %\>
> 
> pass: \<%= f.password\_field :password %\>
> 
> \<%= f.submit 'login' %\> \<% end %\>
> 
> I checked the markup and the hidden field with the token appears. I’m  
> baffled on what keep causing this error - and would appreciate any help.

I should also mention that the exact error is:

ActionController::InvalidAuthenticityTokem in LoginController#do\_login

–  
and in the controller:

def do\_login  
if request.post?  
user = User.authenticate(params[:user\_name], params[:password])  
if user  
session[:user\_id] = user.id  
redirect\_to home\_page  
else  
flash.now[:notice] = “Invalid user/password - please try again”  
end  
end  
end

thanks.

---

<div class="post-metadata">

**Author:** ![sa125](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/b4bc9f/32.png) [@sa125](https://www.ruby-forum.com/u/sa125)\
**Post date:** [February 25, 2009, 6:00pm UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-error-with-db-sessions/161320/3 "2009-02-25T18:00:05Z")

</div>

Right, sorry. Thought it might deserve a seperate thread. Here’s the  
other post if someone wondered here looking for an answer:  
[http://www.ruby-forum.com/topic/179690#786710](http://www.ruby-forum.com/topic/179690#786710)

---

<div class="post-metadata">

**Author:** ![sa125](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/b4bc9f/32.png) [@sa125](https://www.ruby-forum.com/u/sa125)\
**Post date:** [February 25, 2009, 3:17pm UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-error-with-db-sessions/161320/4 "2009-02-25T15:17:10Z")

</div>

i answered to this in your other thread…