# InvalidAuthenticityToken error with remote\_form\_for

**URL:** <https://www.ruby-forum.com/t/invalidauthenticitytoken-error-with-remote-form-for/158036>\
**Category:** Rails\
**Created:** [January 18, 2009, 8:57am UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-error-with-remote-form-for/158036 "2009-01-18T08:57:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gte351s](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/5f9b8f/32.png) [@gte351s](https://www.ruby-forum.com/u/gte351s)\
**Post date:** [January 18, 2009, 8:57am UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-error-with-remote-form-for/158036/1 "2009-01-18T08:57:01Z")

</div>

Hi All -

I have a form\_for that I’m trying to convert to remote\_form\_for, and I  
keep get this error:

ActionController::InvalidAuthenticityToken  
(ActionController::InvalidAuthenticityToken):  
/usr/lib/ruby/gems/1.8/gems/actionpack-2.2.2/lib/action\_controller/request\_forgery\_protection.rb:86:in  
`verify_authenticity_token' /usr/lib/ruby/gems/1.8/gems/activesupport-2.2.2/lib/active_support/callbacks.rb:178:in`send’  
/usr/lib/ruby/gems/1.8/gems/activesupport-2.2.2/lib/active\_support/callbacks.rb:178:in  
`evaluate_method' /usr/lib/ruby/gems/1.8/gems/activesupport-2.2.2/lib/active_support/callbacks.rb:166:in`call’  
/usr/lib/ruby/gems/1.8/gems/actionpack-2.2.2/lib/action\_controller/filters.rb:225:in  
`call’…

My form works fine without the ajax call:

\<% form\_for :vendor do |f| -%\>

 \<%= f.text\_field :name, :size =\> 15 %\> \<%= f.text\_field :location, :size =\> 15 %\> \<%= f.submit 'save' %\> \<% end -%\>

– partial :

\<% @vendor = vendor %\>

 \<%= vendor.name %\> \<%= vendor.location %\>

– controller :

def create  
@vendor = Vendor.new(params[:vendor])  
if @vendor.save  
respond\_to do |format|  
flash[:notice] = “New vendor #{@vendor.name} was saved!”  
format.html { redirect\_to vendors\_path }  
format.js  
end  
end  
end

– rjs :

page.replace\_html ‘flasher’, flash[:notice] unless flash[:notice].blank?  
page.insert\_html :after, ‘vendors\_title’,  
:partial =\> ‘vendor’,  
:object =\> Vendor.find(:all, :order =\> ‘name’)

I tried adding sessions to my app with rake db:sessions:create and rake  
db:migrate, and I also enabled the :secret in my application.rb…

Please help 🙂

---

<div class="post-metadata">

**Author:** ![gte351s](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/5f9b8f/32.png) [@gte351s](https://www.ruby-forum.com/u/gte351s)\
**Post date:** [January 19, 2009, 7:56am UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-error-with-remote-form-for/158036/2 "2009-01-19T07:56:17Z")

</div>

I tried using submit\_to\_remote (or link\_to\_remote) to submit the  
form\_for and it worked:

\<% form\_for :vendor do |f| -%\>  
\<%= f.text\_field :name, :size =\> 15 %\>  
\<%= f.text\_field :location, :size =\> 15 %\>  
\<%# f.submit ‘save’ %\>  
\<%= link\_to\_remote ‘save’,  
:url =\> { :action =\> ‘create’, :id =\> @vendor } %\>  
\<% end -%\>

and in the controller:

def create  
@vendor = Vendor.new(params[:vendor])  
if @vendor.save  
respond\_to do |format|  
format.html { redirect\_to vendors\_path }  
format.js  
end  
end  
end

Of course, I have a create.js.rjs template to handle the ajax events on  
the page.

---

<div class="post-metadata">

**Author:** ![gte351s](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/5f9b8f/32.png) [@gte351s](https://www.ruby-forum.com/u/gte351s)\
**Post date:** [January 20, 2009, 7:34am UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-error-with-remote-form-for/158036/3 "2009-01-20T07:34:20Z")

</div>

If nobody answered this yet, the reason it’s not working is that your  
link doesn’t serialize the authenticity\_token field. Just put:

\<%= link\_to\_remote ‘save’,  
:url =\> { :action =\> ‘create’, :id =\> @vendor }, :with =\>  
‘authenticity\_token’ %\>

and that should get you on the right path.

HTH