# Page\_attachments / :secret / #protect\_from\_forgery error

**URL:** <https://www.ruby-forum.com/t/page-attachments-secret-protect-from-forgery-error/153588>\
**Category:** Radiant CMS\
**Created:** [November 19, 2008, 4:10am UTC](https://www.ruby-forum.com/t/page-attachments-secret-protect-from-forgery-error/153588 "2008-11-19T04:10:56Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![steveluscher](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/3bc359/32.png) [@steveluscher](https://www.ruby-forum.com/u/steveluscher)\
**Post date:** [November 19, 2008, 4:10am UTC](https://www.ruby-forum.com/t/page-attachments-secret-protect-from-forgery-error/153588/1 "2008-11-19T04:10:56Z")

</div>

Hi -

I am haunted by this :secret / #protect\_from\_forgery /  
form\_authenticity\_token error that seems to stop me every few months.  
Luckily it has been in remission for a few months. I just had a few  
hours to finish this site and whammo! Up pops this much feared error.

The cause is that I installed attachment\_fu and page\_attachments into my  
Radiant app. The installs went smoothly until I tried to edit a page.  
Then I got this error:

* * *

```
ActionController::InvalidAuthenticityToken in Admin/page#edit

```

Showing vendor/extensions/page\_attachments/app/views/admin  
/page/\_attachments\_box.html.erb where line #7 raised:

## No :secret given to the #protect\_from\_forgery call. Set that or use a session store capable of generating its own keys (Cookie Session Store).

I’m using Active Record Session Store and I don’t much care for Cookie  
session store because it limits what I can stick in the session. I have  
a :secret defined in my environment.rb and I also have

```
config.action_controller.allow_forgery_protection = false

```

in there. Could somebody tell me how to fix this or point me to  
resources to learn about the forgery protection stuff?

(In the mean time I’m googling this topic)

Thank you.

Steve

---

<div class="post-metadata">

**Author:** ![steveluscher](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/3bc359/32.png) [@steveluscher](https://www.ruby-forum.com/u/steveluscher)\
**Post date:** [November 19, 2008, 4:52am UTC](https://www.ruby-forum.com/t/page-attachments-secret-protect-from-forgery-error/153588/2 "2008-11-19T04:52:24Z")

</div>

This link appears that it will help. I would prefer to build sites  
without learning anything but sometimes I am forced.

[http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html](http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html)

---

<div class="post-metadata">

**Author:** ![steveluscher](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/3bc359/32.png) [@steveluscher](https://www.ruby-forum.com/u/steveluscher)\
**Post date:** [November 19, 2008, 5:16am UTC](https://www.ruby-forum.com/t/page-attachments-secret-protect-from-forgery-error/153588/3 "2008-11-19T05:16:00Z")

</div>

Geez, I don’t know what just happened here, but I stuck this line of  
code in some obscure file I didn’t even know existed and it fixed my  
problem.

I stuck this line of code:

protect\_from\_forgery :secret =\>  
‘asdfqwexxcoivswhallelujah!yippee!fqewwel’, :except =\> :index

into my

radiant-0.6.9/app/controllers/admin/page\_controller.rb

and the error went away.

---

<div class="post-metadata">

**Author:** ![steveluscher](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/3bc359/32.png) [@steveluscher](https://www.ruby-forum.com/u/steveluscher)\
**Post date:** [November 19, 2008, 5:42am UTC](https://www.ruby-forum.com/t/page-attachments-secret-protect-from-forgery-error/153588/4 "2008-11-19T05:42:21Z")

</div>

For some reason, the CSRF protections in Rails require that if you use  
:active\_record\_store for sessions, the key given in your config setting  
must be equivalent to the key given in the call to protect\_from\_forgery  
in the controller. One way around this might be to add an  
after\_initialize block like so:

config.after\_initialize do  
ActionController::Base.request\_forgery\_protection\_options.update  
:secret =\> ‘putyourreallylongsha1hashkeyhere’  
end

Sean

---

<div class="post-metadata">

**Author:** ![steveluscher](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/3bc359/32.png) [@steveluscher](https://www.ruby-forum.com/u/steveluscher)\
**Post date:** [November 19, 2008, 4:16pm UTC](https://www.ruby-forum.com/t/page-attachments-secret-protect-from-forgery-error/153588/5 "2008-11-19T16:16:50Z")

</div>

It seems Rails just patched a CSRF vulnerability yesterday.

[http://weblog.rubyonrails.com/2008/11/18/potential-circumvention-of-csrf-pro](http://weblog.rubyonrails.com/2008/11/18/potential-circumvention-of-csrf-pro)  
tection-in-rails-2-1

Victor

On 11/18/08 11:41 PM, “Sean C.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> > ‘asdfqwexxcoivswhallelujah!yippee!fqewwel’, :except =\> :index  
> > Radiant mailing list  
> > Post: removed\_email\_address@domain.invalid  
> > Search: [http://radiantcms.org/mailing-list/search/](http://radiantcms.org/mailing-list/search/)  
> > Site: [http://lists.radiantcms.org/mailman/listinfo/radiant](http://lists.radiantcms.org/mailman/listinfo/radiant)

Victor Zuniga  
Westerville Public Library  
126 S. State St. | Westerville, OH 43081  
Phone: 614.882.7277 | ext 165