# InvalidAuthenticityToken problems with my login form

**URL:** <https://www.ruby-forum.com/t/invalidauthenticitytoken-problems-with-my-login-form/124007>\
**Category:** Rails\
**Created:** [December 23, 2007, 11:26am UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-problems-with-my-login-form/124007 "2007-12-23T11:26:35Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kadoudal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/f0a364/32.png) [@kadoudal](https://www.ruby-forum.com/u/kadoudal)\
**Post date:** [December 23, 2007, 11:26am UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-problems-with-my-login-form/124007/1 "2007-12-23T11:26:35Z")

</div>

I am trying to convert my codeand to use the new Rails 2.0 feature  
RequestForgeryProtection  
but I get an InvalidAuthenticityToken error, right from the beginning  
with my login form…

I followed the recommandations :

in my environment.rb  
config.action\_controller.session = {  
:session\_key =\> ‘myappname’,  
:secret =\> ‘6de86b5566d7598f57e757960760acd2’  
}

in my application.rb  
protect\_from\_forgery :secret =\> ‘6de86b5566d7598f57e757960760acd2’

my sessions\_controller.rb doesn’t have anything new inside… same code  
as used with rails 1.2  
(is it right ?)

class SessionsController \< ApplicationController  
def new  
@login = “”  
end

def create  
if open\_id?(params[:login])  
open\_id\_authentication params[:login]  
else  
password\_authentication params[:login], params[:password]  
end  
end

what should I take care in this conversion ?

thanks

---

<div class="post-metadata">

**Author:** ![kadoudal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/f0a364/32.png) [@kadoudal](https://www.ruby-forum.com/u/kadoudal)\
**Post date:** [December 23, 2007, 11:44am UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-problems-with-my-login-form/124007/2 "2007-12-23T11:44:22Z")

</div>

On 23 Dec 2007, at 10:26, Kad K. wrote:

> :session\_key =\> ‘myappname’,  
> :secret =\> ‘6de86b5566d7598f57e757960760acd2’  
> }
> 
> in my application.rb  
> protect\_from\_forgery :secret =\> ‘6de86b5566d7598f57e757960760acd2’
> 
> my sessions\_controller.rb doesn’t have anything new inside… same  
> code  
> as used with rails 1.2  
> (is it right ?)

Does your form include the token ?

Fred

---

<div class="post-metadata">

**Author:** ![kadoudal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/f0a364/32.png) [@kadoudal](https://www.ruby-forum.com/u/kadoudal)\
**Post date:** [December 23, 2007, 12:47pm UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-problems-with-my-login-form/124007/3 "2007-12-23T12:47:36Z")

</div>

Frederick C. wrote:

> On 23 Dec 2007, at 10:26, Kad K. wrote:
> 
> > :session\_key =\> ‘myappname’,  
> > :secret =\> ‘6de86b5566d7598f57e757960760acd2’  
> > }
> > 
> > in my application.rb  
> > protect\_from\_forgery :secret =\> ‘6de86b5566d7598f57e757960760acd2’
> > 
> > my sessions\_controller.rb doesn’t have anything new inside… same  
> > code  
> > as used with rails 1.2  
> > (is it right ?)
> 
> Does your form include the token ?
> 
> Fred

yes, I can see the token in the log…  
Parameters: {“commit”=\>“send me a key please”,  
“authenticity\_token”=\>“56e36d73f759d4a3efeadcc71354da428f24efcd”,  
“action”=\>“create”, “controller”=\>“users”,  
“email”=\>“removed\_email\_address@domain.invalid”}

I am using the last rails 2.0.2 rails version (gem install rails) it’s  
stated that the session cookie store is the default with Rails edge…  
am I using the right version ?  
how can I check that the default session store is cookies and not file  
(Pstore was the default before … ?)

kad

---

<div class="post-metadata">

**Author:** ![kadoudal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/f0a364/32.png) [@kadoudal](https://www.ruby-forum.com/u/kadoudal)\
**Post date:** [April 19, 2008, 10:51am UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-problems-with-my-login-form/124007/4 "2008-04-19T10:51:18Z")

</div>

could you try to include prototype in your layout? It’s work for me 🙂

On 23 ÄÅË 2007, 19:59, Kad K. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![kadoudal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/f0a364/32.png) [@kadoudal](https://www.ruby-forum.com/u/kadoudal)\
**Post date:** [December 23, 2007, 1:59pm UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-problems-with-my-login-form/124007/5 "2007-12-23T13:59:15Z")

</div>

> > Does your form include the token ?
> > 
> > Fred
> 
> yes, I can see the token in the log…  
> Parameters: {“commit”=\>“send me a key please”,  
> “authenticity\_token”=\>“56e36d73f759d4a3efeadcc71354da428f24efcd”,  
> “action”=\>“create”, “controller”=\>“users”,  
> “email”=\>“removed\_email\_address@domain.invalid”}
> 
> I am using the last rails 2.0.2 rails version (gem install rails) it’s  
> stated that the session cookie store is the default with Rails edge…  
> am I using the right version ?  
> how can I check that the default session store is cookies and not file  
> (Pstore was the default before … ?)
> 
> kad

that was the case ! I was using 2.0.1 !! not 2.0.2 … it’s ok now !!