# InvalidToken for a Flash upload

**URL:** <https://www.ruby-forum.com/t/invalidtoken-for-a-flash-upload/192542>\
**Category:** Rails\
**Created:** [August 1, 2010, 7:21pm UTC](https://www.ruby-forum.com/t/invalidtoken-for-a-flash-upload/192542 "2010-08-01T19:21:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![lilyweb](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/a6a055/32.png) [@lilyweb](https://www.ruby-forum.com/u/lilyweb)\
**Post date:** [August 1, 2010, 7:21pm UTC](https://www.ruby-forum.com/t/invalidtoken-for-a-flash-upload/192542/1 "2010-08-01T19:21:26Z")

</div>

Hi,

I am developping a small Flash app to upload multiple files with a  
progress bar in a Rails site.

Rails handles the server side. I have a controller that displays the  
view containing the flash, and it also provides a security token to the  
flash. The Flash gets it and send it back to the server in the HTTP  
request that contains the file to upload.

Big surprise : it works perfectly in Internet Explorer… but not in  
Firefox nor in Opera. :S

For Firefox and Opera, I get a  
ActionController::InvalidAuthenticityToken in the console.

I display the token in text in the console, in the view html and in the  
flash, and the token doesn’t seem to be altered (though I had to  
CGI.escape the token to get it right in Flash, and escape it again in  
Flash to send it back, just because of the “+” that the token can  
contains).

This is what the console shows for Firefox :

Token from controller = ayZ/bR7r2W3qg61NIspeOsU0N/VBqHqjWamkRtQG+s4=  
←[4;36;1mSQL (0.0ms)←[0m ←[0;1mSET SQL\_AUTO\_IS\_NULL=0←[0m

Processing UploadController#form (for 127.0.0.1 at 2010-08-01 13:12:25)  
[GET]  
Rendering upload/form  
Completed in 11ms (View: 9, DB: 0) | 200 OK [[http://localhost/](http://localhost/)]  
←[4;35;1mSQL (0.0ms)←[0m ←[0mSET SQL\_AUTO\_IS\_NULL=0←[0m

Processing UploadController#index (for 127.0.0.1 at 2010-08-01 13:12:29)  
[POST]  
Parameters: {“Filename”=\>“Screenshot-14.jpg”,  
“authenticity\_token”=\>“ayZ/bR7r2  
W3qg61NIspeOsU0N/VBqHqjWamkRtQG+s4=”, “Upload”=\>“Submit Query”,  
“Filedata”=\>#\<File:C:/Users/Lily/AppData/Local/Temp/RackMultipart.4856.0\>}

ActionController::InvalidAuthenticityToken  
(ActionController::InvalidAuthenticit  
yToken):

And now for Internet Explorer :

Token from controller = i1irXTa0JqlbBNTlfcRwFYdQ24L8yhTBQFWESSrSEZg=  
g=&=]  
←[4;35;1mSQL (0.0ms)←[0m ←[0mSET SQL\_AUTO\_IS\_NULL=0←[0m

Processing UploadController#form (for 127.0.0.1 at 2010-08-01 13:15:02)  
[GET]  
Rendering upload/form  
Completed in 4ms (View: 2, DB: 0) | 200 OK [[http://localhost/](http://localhost/)]  
ost/]  
←[4;36;1mSQL (0.0ms)←[0m ←[0;1mSET SQL\_AUTO\_IS\_NULL=0←[0m

Processing UploadController#index (for 127.0.0.1 at 2010-08-01 13:15:19)  
[POST]  
Parameters: {“Filename”=\>“MobilePhone\_Icon.jpg”,  
“authenticity\_token”=\>“i1irXT  
a0JqlbBNTlfcRwFYdQ24L8yhTBQFWESSrSEZg=”, “Upload”=\>“Submit Query”,  
“Filedata”=\>#\<File:C:/Users/Lily/AppData/Local/Temp/RackMultipart.4  
856.2\>}  
Completed in 8ms (View: 1, DB: 0) | 200 OK  
[[http://localhost/upload?authenticity](http://localhost/upload?authenticity)  
\_token=i1irXTa0JqlbBNTlfcRwFYdQ24L8yhTBQFWESSrSEZg=]

Could someone help me about this ? I searched quite a while on the net  
for an explaination; I found some people fix for Swfupload and  
Uploadify/Paperclip but couldn’t get a solution out of it.

(I’m using Rails 2.3.5 and Ruby 1.8.6 on this project, the Flash  
application is in ActionScript 3 compiled for the player 10)

---

<div class="post-metadata">

**Author:** ![lilyweb](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/a6a055/32.png) [@lilyweb](https://www.ruby-forum.com/u/lilyweb)\
**Post date:** [August 3, 2010, 9:47pm UTC](https://www.ruby-forum.com/t/invalidtoken-for-a-flash-upload/192542/2 "2010-08-03T21:47:03Z")

</div>

Lily 🙂 wrote:

> Hi,
> 
> I am developping a small Flash app to upload multiple files with a  
> progress bar in a Rails site.
> 
> Rails handles the server side. I have a controller that displays the  
> view containing the flash, and it also provides a security token to the  
> flash. The Flash gets it and send it back to the server in the HTTP  
> request that contains the file to upload.
> 
> Big surprise : it works perfectly in Internet Explorer… but not in  
> Firefox nor in Opera. :S
> 
> For Firefox and Opera, I get a  
> ActionController::InvalidAuthenticityToken in the console.
> 
> I display the token in text in the console, in the view html and in the  
> flash, and the token doesn’t seem to be altered (though I had to  
> CGI.escape the token to get it right in Flash, and escape it again in  
> Flash to send it back, just because of the “+” that the token can  
> contains).
> 
> This is what the console shows for Firefox :
> 
> Token from controller = ayZ/bR7r2W3qg61NIspeOsU0N/VBqHqjWamkRtQG+s4=  
> ←[4;36;1mSQL (0.0ms)←[0m ←[0;1mSET SQL\_AUTO\_IS\_NULL=0←[0m
> 
> Processing UploadController#form (for 127.0.0.1 at 2010-08-01 13:12:25)  
> [GET]  
> Rendering upload/form  
> Completed in 11ms (View: 9, DB: 0) | 200 OK [[http://localhost/](http://localhost/)]  
> ←[4;35;1mSQL (0.0ms)←[0m ←[0mSET SQL\_AUTO\_IS\_NULL=0←[0m
> 
> Processing UploadController#index (for 127.0.0.1 at 2010-08-01 13:12:29)  
> [POST]  
> Parameters: {“Filename”=\>“Screenshot-14.jpg”,  
> “authenticity\_token”=\>“ayZ/bR7r2  
> W3qg61NIspeOsU0N/VBqHqjWamkRtQG+s4=”, “Upload”=\>“Submit Query”,  
> “Filedata”=\>#\<File:C:/Users/Lily/AppData/Local/Temp/RackMultipart.4856.0\>}
> 
> ActionController::InvalidAuthenticityToken  
> (ActionController::InvalidAuthenticit  
> yToken):
> 
> And now for Internet Explorer :
> 
> Token from controller = i1irXTa0JqlbBNTlfcRwFYdQ24L8yhTBQFWESSrSEZg=  
> g=&=]  
> ←[4;35;1mSQL (0.0ms)←[0m ←[0mSET SQL\_AUTO\_IS\_NULL=0←[0m
> 
> Processing UploadController#form (for 127.0.0.1 at 2010-08-01 13:15:02)  
> [GET]  
> Rendering upload/form  
> Completed in 4ms (View: 2, DB: 0) | 200 OK [[http://localhost/](http://localhost/)]  
> ost/]  
> ←[4;36;1mSQL (0.0ms)←[0m ←[0;1mSET SQL\_AUTO\_IS\_NULL=0←[0m
> 
> Processing UploadController#index (for 127.0.0.1 at 2010-08-01 13:15:19)  
> [POST]  
> Parameters: {“Filename”=\>“MobilePhone\_Icon.jpg”,  
> “authenticity\_token”=\>“i1irXT  
> a0JqlbBNTlfcRwFYdQ24L8yhTBQFWESSrSEZg=”, “Upload”=\>“Submit Query”,  
> “Filedata”=\>#\<File:C:/Users/Lily/AppData/Local/Temp/RackMultipart.4  
> 856.2\>}  
> Completed in 8ms (View: 1, DB: 0) | 200 OK  
> [[http://localhost/upload?authenticity](http://localhost/upload?authenticity)  
> \_token=i1irXTa0JqlbBNTlfcRwFYdQ24L8yhTBQFWESSrSEZg=]
> 
> Could someone help me about this ? I searched quite a while on the net  
> for an explaination; I found some people fix for Swfupload and  
> Uploadify/Paperclip but couldn’t get a solution out of it.
> 
> (I’m using Rails 2.3.5 and Ruby 1.8.6 on this project, the Flash  
> application is in ActionScript 3 compiled for the player 10)

Still searching for a solution, if anyone could help. I really searched  
the web and found some tips but I still couldn’t find out a solution.  
The upload stills work with IE and not with other browser. I read  
somewhere that it could be a problem of session id and tried this fix  
that supposed to override the middleware. But I don’t think I understand  
what my Flash should eventually send to work…

require ‘rack/utils’

class FlashSessionCookieMiddleware  
def initialize(app, session\_key = ‘\_session\_id’)  
@app = app  
@session\_key = session\_key  
end

def call(env)  
if env[‘HTTP\_USER\_AGENT’] =~ /^(Adobe|Shockwave) Flash/  
puts “\*\*\*\*\* yeaaahh I’m in the condition !”  
puts "\*\*\*\*\* Session key is : " + @session\_key.to\_s + " and @app :  
" + @app.to\_s  
params = ::Rack::Utils.parse\_query(env[‘QUERY\_STRING’])  
env[‘HTTP\_COOKIE’] = [@session\_key, params[‘session\_key’]  
].join(‘=’).freeze unless params[‘session\_key’].nil?  
end  
@app.call(env)  
end  
end

By the way, this fix doesn’t change that IE works anyway, and not FF nor  
Opera…