# Protect\_from\_forgery issue

**URL:** <https://www.ruby-forum.com/t/protect-from-forgery-issue/168683>\
**Category:** Rails\
**Created:** [May 24, 2009, 9:23am UTC](https://www.ruby-forum.com/t/protect-from-forgery-issue/168683 "2009-05-24T09:23:12Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![philswenson](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/7feea3/32.png) [@philswenson](https://www.ruby-forum.com/u/philswenson)\
**Post date:** [May 24, 2009, 9:23am UTC](https://www.ruby-forum.com/t/protect-from-forgery-issue/168683/1 "2009-05-24T09:23:12Z")

</div>

Hi,  
I just redeployed my app for a very minor source code change and now I  
am getting these errors:  
No :secret given to the #protect\_from\_forgery call

for a page that has a remote\_form\_for on it.

1. Why would this change? The offender seems to usually be Googlebot,  
but not always. I’ve been always getting lots of google bot hits, so  
what has changed now.
2. Why only on this one page? I actually include the partial that  
contains the code it is complaining about on almost every page
3. What can I do to fix it?

For me the weird thing is that it is not giving me the error when  
googlebot tries to call the remote form, but actually it seems to be  
happening when it is trying to render it!

Should I be using a secret

I am running rails 2.1.2 (via ec2onrails).

Help! Our hoptoad is reporting 150 of these since yesterday!