# InvalidAuthenticityToken from home page

**URL:** <https://www.ruby-forum.com/t/invalidauthenticitytoken-from-home-page/162622>\
**Category:** Rails\
**Created:** [March 12, 2009, 2:24am UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-from-home-page/162622 "2009-03-12T02:24:09Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![prichard](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/90db22/32.png) [@prichard](https://www.ruby-forum.com/u/prichard)\
**Post date:** [March 12, 2009, 2:24am UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-from-home-page/162622/1 "2009-03-12T02:24:09Z")

</div>

I’m trying to create a log in in index.html, but I keep getting an error  
about InvalidAuthenticityToken. I understand this is something that RoR  
puts in the forms, and it changes regularly. The problem is that the  
home page in the public folder is html, and therefore static. has anyone  
else put a log in on their home page?

---

<div class="post-metadata">

**Author:** ![prichard](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/90db22/32.png) [@prichard](https://www.ruby-forum.com/u/prichard)\
**Post date:** [March 12, 2009, 3:56am UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-from-home-page/162622/2 "2009-03-12T03:56:13Z")

</div>

Is it a form? Is the index.html in rails root or the webservers root?  
If its rails you can still use the form helpers or pull in a  
partial…

On Mar 11, 6:24 pm, Paul R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![prichard](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/90db22/32.png) [@prichard](https://www.ruby-forum.com/u/prichard)\
**Post date:** [March 12, 2009, 4:23am UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-from-home-page/162622/3 "2009-03-12T04:23:06Z")

</div>

@Paul:

You need to disable forgery protection on the login action in order to  
use a static home page.

Assuming your login is processed by restful\_authentication’s  
sessions\_controller.rb, add this to that class:

protect\_from\_forgery, :except =\> [:create]

That’s it. If that’s unacceptable to you, remove the login form from  
the homepage and replace it with a link to the login page.

Hope that helps!

---

<div class="post-metadata">

**Author:** ![prichard](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/90db22/32.png) [@prichard](https://www.ruby-forum.com/u/prichard)\
**Post date:** [March 12, 2009, 4:54am UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-from-home-page/162622/4 "2009-03-12T04:54:31Z")

</div>

Thanks for the replies. @Brian, that worked - thank you 🙂

---

<div class="post-metadata">

**Author:** ![prichard](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/90db22/32.png) [@prichard](https://www.ruby-forum.com/u/prichard)\
**Post date:** [March 12, 2009, 10:31am UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-from-home-page/162622/5 "2009-03-12T10:31:06Z")

</div>

you also can set forgery protection to false  
In rails 2, it is true by default.

Set in environment file

config.action\_controller.allow\_forgery\_protection = false

On Mar 12, 8:54 am, Paul R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![prichard](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/90db22/32.png) [@prichard](https://www.ruby-forum.com/u/prichard)\
**Post date:** [March 12, 2009, 2:08pm UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-from-home-page/162622/6 "2009-03-12T14:08:23Z")

</div>

@seja:

Yeah but that’s for the entire app, and it’s not a good idea to  
disable it for the entire ap.