# InvalidAuthenticityToken when using XML, why?

**URL:** <https://www.ruby-forum.com/t/invalidauthenticitytoken-when-using-xml-why/153492>\
**Category:** Rails\
**Created:** [November 17, 2008, 11:26pm UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-when-using-xml-why/153492 "2008-11-17T23:26:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![comopasta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/59ef9b/32.png) [@comopasta](https://www.ruby-forum.com/u/comopasta)\
**Post date:** [November 17, 2008, 11:26pm UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-when-using-xml-why/153492/1 "2008-11-17T23:26:57Z")

</div>

Hi,

I’m making an app where messages can be posted only from mobile phones.  
The clients that will connect to the app will NOT use a browser but the  
client is developed using native language, say C++, Java, etc. Users  
need to be registered to be able to post.

On the server I am using restful\_authentication. Clients will use XML to  
post stuff to the server.

It is simple to use HTTP Basic authentication to post messages. But I’d  
like to have a real API to login once and then provide a token to the  
client so the next requests are done just using the token, actually I  
could even use the remember me token.

My problem is that when I try this a POST to  
[http://127.0.0.1](http://127.0.0.1).:3000/session.xml  
I get ActionController::InvalidAuthenticityToken  
(ActionController::InvalidAuthenticityToken):  
So I can’t get into the controller to start working on the logic I need.

* * *

I also confused since the rails docs  
([ActionController::RequestForgeryProtection::ClassMethods](http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html))  
state that “Only HTML/JavaScript requests are checked, so this will not  
protect your XML API”

I’m using XML here so why is the token being checked?

* * *

Any hints appreciated.

Cheers.

---

<div class="post-metadata">

**Author:** ![comopasta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/59ef9b/32.png) [@comopasta](https://www.ruby-forum.com/u/comopasta)\
**Post date:** [November 19, 2008, 12:08pm UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-when-using-xml-why/153492/2 "2008-11-19T12:08:57Z")

</div>

Hi,

For the sake of sharing with others in case it might help…

I had to add Content-Type: text/xml to the headers in the post request.  
Doing that stopped the token error.

Now I have started doing some changes so the mobile client can login  
with XML and receive a new client\_auth\_token. For that I have created a  
new remember token for the mobile case to the user model, so I can use  
the existing remember me functionality of restful\_authentication as a  
base. The client uses that cookie for using the API. Some changes to the  
plugin are needed for this but I hope/think I’m in the right track.

Cheers.