# Question on authenticity tokens

**URL:** <https://www.ruby-forum.com/t/question-on-authenticity-tokens/136965>\
**Category:** Rails\
**Created:** [May 7, 2008, 7:31pm UTC](https://www.ruby-forum.com/t/question-on-authenticity-tokens/136965 "2008-05-07T19:31:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![chrisolsen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c6cbf5/32.png) [@chrisolsen](https://www.ruby-forum.com/u/chrisolsen)\
**Post date:** [May 7, 2008, 7:31pm UTC](https://www.ruby-forum.com/t/question-on-authenticity-tokens/136965/1 "2008-05-07T19:31:33Z")

</div>

Does anyone find them useful? I can see them being good in some cases,  
but I have many exceptions that occur because of expired sessions. I am  
also not sure if they are really required for pages that require a login  
to access.

The other place that they cause issues is in javascript requests. I am  
not using the built-in helpers, and all the javascript exists in  
separate js files. There is ways to get around this, but they are  
sloppy.

Is there a way to turn them off?

## Here is an example of the the code requires the token. If anyone knows an easy way to solve the problem please let me know.

$(document).ready(function(){  
$(".photos img").draggable();  
$("#trash").droppable({  
accept: “img”,  
drop: function(ev, ui){  
var url = window.location + “/photos/” + ui.draggable.attr(“id”);  
$.post(url, {’\_method’: “delete”, ‘authenticity\_token’:  
“need\_the\_users\_token\_here”}, function(){  
$(ui.draggable).remove();  
});  
return false;  
}  
});  
});

---

<div class="post-metadata">

**Author:** ![chrisolsen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c6cbf5/32.png) [@chrisolsen](https://www.ruby-forum.com/u/chrisolsen)\
**Post date:** [May 7, 2008, 7:48pm UTC](https://www.ruby-forum.com/t/question-on-authenticity-tokens/136965/2 "2008-05-07T19:48:35Z")

</div>

On 7 May 2008, at 18:31, Chris O. wrote:

> am  
> not using the built-in helpers, and all the javascript exists in  
> separate js files. There is ways to get around this, but they are  
> sloppy.
> 
> Is there a way to turn them off?  
> It’s turned on by the protect\_from\_forgery line in your  
> application.rb. The rdoc for that method should you how to have it  
> enabled only for some stuff and how to generate the token

## Fred

My ramblings: [http://www.spacevatican.org](http://www.spacevatican.org)

---

<div class="post-metadata">

**Author:** ![chrisolsen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c6cbf5/32.png) [@chrisolsen](https://www.ruby-forum.com/u/chrisolsen)\
**Post date:** [May 7, 2008, 8:19pm UTC](https://www.ruby-forum.com/t/question-on-authenticity-tokens/136965/3 "2008-05-07T20:19:38Z")

</div>

Hey Fred,  
Thanks for the info.

As mentioned in the protect\_from\_forgery docs, setting a window.\_token  
var in the application template file allows for one to easily pass the  
token.

ex  
$.post(url, {‘\_method’: “delete”, ‘authenticity\_token’: window.\_token},  
function(){  
…

For one small live app I get the occasional exception email notifying me  
that someones authentication token expired. I have never been able to  
replicate this exception. Does anyone know if the user is getting  
slapped with a 422, or are they just being redirected to the login page?

Thanks.

Frederick C. wrote:

> On 7 May 2008, at 18:31, Chris O. wrote:
> 
> > am  
> > not using the built-in helpers, and all the javascript exists in  
> > separate js files. There is ways to get around this, but they are  
> > sloppy.
> > 
> > Is there a way to turn them off?  
> > It’s turned on by the protect\_from\_forgery line in your  
> > application.rb. The rdoc for that method should you how to have it  
> > enabled only for some stuff and how to generate the token
> 
> ## Fred
> 
> My ramblings: [http://www.spacevatican.org](http://www.spacevatican.org)