# InvalidAuthenticityToken with Lightview

**URL:** <https://www.ruby-forum.com/t/invalidauthenticitytoken-with-lightview/144364>\
**Category:** Rails\
**Created:** [July 29, 2008, 1:00am UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-with-lightview/144364 "2008-07-29T01:00:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![elliotchyba](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/8dc957/32.png) [@elliotchyba](https://www.ruby-forum.com/u/elliotchyba)\
**Post date:** [July 29, 2008, 1:00am UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-with-lightview/144364/1 "2008-07-29T01:00:49Z")

</div>

Hi,

I’m integrating Lightview,  
[http://www.nickstakenburg.com/projects/lightview/](http://www.nickstakenburg.com/projects/lightview/), into an application.  
It’s more or less a content overlay similar to a light box, which then  
calls the content either through an IFRAME or Ajax request. The IFRAME  
works fine but for obvious reasons, I’d prefer to use Ajax but whenever  
I use that option, I get the dreaded InvalidAuthenticityToken error.

Do any ideas come to mind?

---

<div class="post-metadata">

**Author:** ![elliotchyba](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/8dc957/32.png) [@elliotchyba](https://www.ruby-forum.com/u/elliotchyba)\
**Post date:** [July 29, 2008, 9:36am UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken-with-lightview/144364/2 "2008-07-29T09:36:58Z")

</div>

On 29 Jul 2008, at 01:00, Elliot C. wrote:

> I’m integrating Lightview,  
> [http://www.nickstakenburg.com/projects/lightview/](http://www.nickstakenburg.com/projects/lightview/), into an  
> application.  
> It’s more or less a content overlay similar to a light box, which then  
> calls the content either through an IFRAME or Ajax request. The IFRAME  
> works fine but for obvious reasons, I’d prefer to use Ajax but  
> whenever  
> I use that option, I get the dreaded InvalidAuthenticityToken error.
> 
> Do any ideas come to mind?

Add this in the section of your main layout file:

```
 <script type="text/javascript" charset="utf-8">
     window._token = '<%= form_authenticity_token -%>';
 </script>

```

Add this on top of your /javascripts/application.js file:

Ajax.Base.prototype.initialize = Ajax.Base.prototype.initialize.wrap(  
function(p, options){  
p(options);  
this.options.parameters = this.options.parameters || {};  
this.options.parameters.authenticity\_token = window.\_token || ‘’;  
}  
);

Presto! All ajax requests that are called from your own javascript  
code will have the authenticity string added to the parameters.

Best regards

Peter De Berdt