# Protect\_from\_forgery development mode

**URL:** <https://www.ruby-forum.com/t/protect-from-forgery-development-mode/177004>\
**Category:** Rails\
**Created:** [October 9, 2009, 4:55pm UTC](https://www.ruby-forum.com/t/protect-from-forgery-development-mode/177004 "2009-10-09T16:55:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![John\_van\_Dijk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/48db29/32.png) [@John\_van\_Dijk](https://www.ruby-forum.com/u/John_van_Dijk)\
**Post date:** [October 9, 2009, 4:55pm UTC](https://www.ruby-forum.com/t/protect-from-forgery-development-mode/177004/1 "2009-10-09T16:55:18Z")

</div>

Should this be working in development mode?  
For some reason it doesn’t.

regards, John

---

<div class="post-metadata">

**Author:** ![John\_van\_Dijk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/48db29/32.png) [@John\_van\_Dijk](https://www.ruby-forum.com/u/John_van_Dijk)\
**Post date:** [October 10, 2009, 1:42am UTC](https://www.ruby-forum.com/t/protect-from-forgery-development-mode/177004/2 "2009-10-10T01:42:08Z")

</div>

It’s working with Ruby1.9.1p243/Rails2.3.4.  
Check config/environments/development.rb and make sure you don’t have  
“config.action\_controller.allow\_forgery\_protection = false” in there.

Add protect\_from\_forgery to ApplicationController and you should see a  
\<input type=“hidden” name=“authenticity\_token” value="…/\> on  
your POST pages.