# InvalidAuthenticityToken exception when deleting cookies

**URL:** <https://www.ruby-forum.com/t/invalidauthenticitytoken-exception-when-deleting-cookies/134872>\
**Category:** Rails\
**Created:** [April 15, 2008, 8:41pm UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-exception-when-deleting-cookies/134872 "2008-04-15T20:41:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![spacechurro](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/d2c977/32.png) [@spacechurro](https://www.ruby-forum.com/u/spacechurro)\
**Post date:** [April 15, 2008, 8:41pm UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-exception-when-deleting-cookies/134872/1 "2008-04-15T20:41:13Z")

</div>

Hello,

I’ve been testing my project with some manual tests. One of them  
consists of deleting cookies (“clean personal info” in firefox) just  
before submit the login form. Then, I get an error.

The error message is: ActionController::InvalidAuthenticityToken in  
SessionsController#create

I’m on Rails 2.0.2 with restful\_authentication plugin. I’m using default  
cookie session store, too.

Any idea?

Thanks.

---

<div class="post-metadata">

**Author:** ![spacechurro](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/d2c977/32.png) [@spacechurro](https://www.ruby-forum.com/u/spacechurro)\
**Post date:** [April 15, 2008, 9:19pm UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-exception-when-deleting-cookies/134872/2 "2008-04-15T21:19:28Z")

</div>

On 15 Apr 2008, at 19:40, Sergio wrote:

> The error message is: ActionController::InvalidAuthenticityToken in  
> SessionsController#create
> 
> Any idea?

This is Rails CSRF protection kicking in, see:

[http://api.rubyonrails.com/classes/ActionController/RequestForgeryProtection.html](http://api.rubyonrails.com/classes/ActionController/RequestForgeryProtection.html)

Try reloading the page with the form before submitting.

Will.

---

<div class="post-metadata">

**Author:** ![spacechurro](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/d2c977/32.png) [@spacechurro](https://www.ruby-forum.com/u/spacechurro)\
**Post date:** [April 17, 2008, 1:13am UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-exception-when-deleting-cookies/134872/3 "2008-04-17T01:13:18Z")

</div>

On 15 abr, 21:17, Will J. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Try reloading the page with the form before submitting.

But can I reload the page automatically before submitting? or I must  
trust the user to do it… How can I avoid the user getting that  
exception?

Thanks!

---

<div class="post-metadata">

**Author:** ![spacechurro](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/d2c977/32.png) [@spacechurro](https://www.ruby-forum.com/u/spacechurro)\
**Post date:** [April 19, 2008, 10:47am UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-exception-when-deleting-cookies/134872/4 "2008-04-19T10:47:12Z")

</div>

could you try to include prototype in your layout? It’s work for me 🙂

---

<div class="post-metadata">

**Author:** ![spacechurro](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/d2c977/32.png) [@spacechurro](https://www.ruby-forum.com/u/spacechurro)\
**Post date:** [April 19, 2008, 4:53pm UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-exception-when-deleting-cookies/134872/5 "2008-04-19T16:53:19Z")

</div>

Thank you, I tried it, but it doesn’t seem to fix the error.