# InvalidAuthenticityToken

**URL:** <https://www.ruby-forum.com/t/invalidauthenticitytoken/174542>\
**Category:** Rails\
**Created:** [August 28, 2009, 1:02pm UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken/174542 "2009-08-28T13:02:33Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![karthik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/9fc348/32.png) [@karthik](https://www.ruby-forum.com/u/karthik)\
**Post date:** [August 28, 2009, 1:02pm UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken/174542/1 "2009-08-28T13:02:33Z")

</div>

Hi guys

What does the below line says

ActionController::InvalidAuthenticityToken  
(ActionController::InvalidAuthenticityToken):  
-e:2:in `load’  
-e:2

Please guide me

–  
Karthik.k  
Mobile - +91-9894991640

---

<div class="post-metadata">

**Author:** ![karthik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/9fc348/32.png) [@karthik](https://www.ruby-forum.com/u/karthik)\
**Post date:** [August 28, 2009, 8:44pm UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken/174542/2 "2009-08-28T20:44:28Z")

</div>

> What does the below line says
> 
> ActionController::InvalidAuthenticityToken  
> (ActionController::InvalidAuthenticityToken):  
> -e:2:in `load’  
> -e:2

Rails tries to protect against invalid form submission by setting an  
authenticity token. It does this automatically if you use the form  
helpers, but if you hard code a form or it’s doing something odd  
(built with javascript, cached and displayed on multiple pages, etc…)  
the token won’t get sent.

Go look at a normal rails form and you’ll see a hidden field in the  
form “authenticity\_token”.

You can tell your controller to ignore it or you can add it yourself.

> **[ActionController::RequestForgeryProtection](https://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection.html#M000512)**
>
> Controller actions are protected from Cross-Site Request Forgery (CSRF) attacks by including a token in the rendered HTML for your application.

For example in one of my forms built from jss and using ajax I pass  
this along…

submitdata: {\<%= request\_forgery\_protection\_token.to\_s %\>: ‘\<%=  
form\_authenticity\_token.to\_s %\>’}

In another form which doesn’t use the Rails helpers so doesn’t get the  
token set automatically I simply include this b/n my form tags:

\<%= token\_tag %\>

Good luck!

-philip

---

<div class="post-metadata">

**Author:** ![karthik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/9fc348/32.png) [@karthik](https://www.ruby-forum.com/u/karthik)\
**Post date:** [August 29, 2009, 10:12am UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken/174542/3 "2009-08-29T10:12:13Z")

</div>

On Fri, Aug 28, 2009 at 9:28 PM, Philip H. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> helpers, but if you hard code a form or it’s doing something odd
> 
> Good luck!
> 
> -philip

Hi philip

Thank You

–  
Karthik.k  
Mobile - +91-9894991640

---

<div class="post-metadata">

**Author:** ![karthik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/9fc348/32.png) [@karthik](https://www.ruby-forum.com/u/karthik)\
**Post date:** [September 1, 2009, 7:36am UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken/174542/4 "2009-09-01T07:36:12Z")

</div>

On Mon, Aug 31, 2009 at 12:57 PM, Peter De Berdt  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)wrote:

> -e:2:in `load’  
> Go look at a normal rails form and you’ll see a hidden field in the  
> submitdata: {\<%= request\_forgery\_protection\_token.to\_s %\>: '\<%=
> 
> Ajax.Base.prototype.initialize = Ajax.Base.prototype.initialize.wrap(  
> Best regards
> 
> Peter De Berdt

Hi Peter De Berdt

Thank you

–  
Karthik.k  
Mobile - +91-9894991640

---

<div class="post-metadata">

**Author:** ![karthik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/9fc348/32.png) [@karthik](https://www.ruby-forum.com/u/karthik)\
**Post date:** [August 31, 2009, 9:28am UTC](https://www.ruby-forum.com/t/invalidauthenticitytoken/174542/5 "2009-08-31T09:28:47Z")

</div>

On 28 Aug 2009, at 17:58, Philip H. wrote:

> (built with javascript, cached and displayed on multiple pages, etc…)  
> this along…
> 
> submitdata: {\<%= request\_forgery\_protection\_token.to\_s %\>: ‘\<%=  
> form\_authenticity\_token.to\_s %\>’}
> 
> In another form which doesn’t use the Rails helpers so doesn’t get the  
> token set automatically I simply include this b/n my form tags:
> 
> \<%= token\_tag %\>

You can easily handle this in a generic way for all custom javascript  
(without having to add it manually every time):

In your main layout html , put:

Then in public/javascripts/application.js, add (assuming that you  
using Prototype, similar options should exist for just about any  
javascript framework out there):

Ajax.Base.prototype.initialize = Ajax.Base.prototype.initialize.wrap(  
function(p, options){  
p(options);  
this.options.parameters = this.options.parameters || {};  
this.options.parameters.authenticity\_token = window.\_token || ‘’;  
}  
);

Problem solved, no need to ever worry about it again.

Best regards

Peter De Berdt