# Rails 2.0.2 form\_tag/InvalidAuthenticityToken/token\_tag

**URL:** <https://www.ruby-forum.com/t/rails-2-0-2-form-tag-invalidauthenticitytoken-token-tag/127136>\
**Category:** Rails\
**Created:** [January 25, 2008, 9:37am UTC](https://www.ruby-forum.com/t/rails-2-0-2-form-tag-invalidauthenticitytoken-token-tag/127136 "2008-01-25T09:37:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![soderic](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/8baadc/32.png) [@soderic](https://www.ruby-forum.com/u/soderic)\
**Post date:** [January 25, 2008, 9:37am UTC](https://www.ruby-forum.com/t/rails-2-0-2-form-tag-invalidauthenticitytoken-token-tag/127136/1 "2008-01-25T09:37:24Z")

</div>

|I just upgraded to rails 2.0.2 and I’m having a problem when I switch  
from cookie based sessions to ActiveRecord based sessions.

Apparently my login form which worked under rails 1.2.6 no longer  
includes the proper authentication token necessary for  
protect\_from\_forgery.

There are a number of people who appear to have this problem and I’ve  
seen suggestions indicating I need to include \<%= token\_tag %\>. But  
token\_tag is a private method and as far as I can tell, is being called.  
So how do I get the form\_tag to work properly under rails 2.0.2?

This is what I currently have:

```
<p> Please enter your username and password to access the site.</p>

<% form_tag :action => 'login' do -%>
  <p><label for="login_name">Name</label><br/>
  <%= text_field 'login', 'name' %></p>

  <p><label for="login_password">Password</label><br/>
  <%= password_field 'login', 'password' %></p>

  <%= submit_tag "Login" %>
<% end -%>

```

TIA  
EMS  
|

---

<div class="post-metadata">

**Author:** ![soderic](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/8baadc/32.png) [@soderic](https://www.ruby-forum.com/u/soderic)\
**Post date:** [January 25, 2008, 10:00am UTC](https://www.ruby-forum.com/t/rails-2-0-2-form-tag-invalidauthenticitytoken-token-tag/127136/2 "2008-01-25T10:00:15Z")

</div>

On Jan 25, 2:36 am, “Eric M. Smith” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> ```
> <%= submit_tag "Login" %>
> <% end -%>
> 
> ```
> 
> TIA  
> EMS  
> |

Ok, I think I found the problem. Apparently, in the  
ApplicationController (application.rb) the secret key is disabled on  
the call to protect\_from\_forgery and it’s only a comment that tells  
you to uncomment if you change the data store.

Once I uncommented the :secret value, things appear to work.

EMS

---

<div class="post-metadata">

**Author:** ![soderic](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/8baadc/32.png) [@soderic](https://www.ruby-forum.com/u/soderic)\
**Post date:** [February 8, 2008, 1:23pm UTC](https://www.ruby-forum.com/t/rails-2-0-2-form-tag-invalidauthenticitytoken-token-tag/127136/3 "2008-02-08T13:23:40Z")

</div>

I’m having the same problem with a similar form. I commented and  
uncommented the secret key in application.rb but not work. I compared  
the the value in the hidden field of the form with the value generated  
for the tag “token\_tag” and be the same.