# Rails3 pre and protect\_from\_forgery

**URL:** <https://www.ruby-forum.com/t/rails3-pre-and-protect-from-forgery/183164>\
**Category:** Rails\
**Created:** [February 9, 2010, 9:57am UTC](https://www.ruby-forum.com/t/rails3-pre-and-protect-from-forgery/183164 "2010-02-09T09:57:51Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![bshelton229](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/90ced4/32.png) [@bshelton229](https://www.ruby-forum.com/u/bshelton229)\
**Post date:** [February 9, 2010, 9:57am UTC](https://www.ruby-forum.com/t/rails3-pre-and-protect-from-forgery/183164/1 "2010-02-09T09:57:51Z")

</div>

I’ve almost entirely converted a rails 2.3.5 app to 3pre. I’m having  
some trouble with protect\_from\_forgery. I had protect\_from\_forgery set  
in application\_controller.rb, but run some uploadify ajax stuff in one  
of my controllers, where I had protect\_from\_forgery, :except  
=\> :add\_file set.

In rails 3 I’m getting ActionController::InvalidAuthenticityToken on  
the ajax upload unless I turn off protect\_from\_forgery completely in  
application\_controller.rb. Seems like the exception in my FileUpload  
controller (protect\_from\_forgery :except =\> :add\_file) isn’t taking.

Has anyone else experienced this. Should I report a bug or am I doing  
something wrong?

Thanks in advance,  
Bryan

---

<div class="post-metadata">

**Author:** ![bshelton229](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/90ced4/32.png) [@bshelton229](https://www.ruby-forum.com/u/bshelton229)\
**Post date:** [February 9, 2010, 6:16pm UTC](https://www.ruby-forum.com/t/rails3-pre-and-protect-from-forgery/183164/2 "2010-02-09T18:16:37Z")

</div>

Hey Bryan, please do report a bug on Lighthouse. Let’s get that fixed  
up for the next beta.

Thanks!  
jeremy

On Mon, Feb 8, 2010 at 7:24 PM, bshelton229

---

<div class="post-metadata">

**Author:** ![bshelton229](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/90ced4/32.png) [@bshelton229](https://www.ruby-forum.com/u/bshelton229)\
**Post date:** [April 9, 2010, 10:49pm UTC](https://www.ruby-forum.com/t/rails3-pre-and-protect-from-forgery/183164/3 "2010-04-09T22:49:01Z")

</div>

I’m experiencing the same issue when implementing Uploadify into a  
Rails 3.0.0.beta2 application. A comment and a question:

1. You shouldn’t need to disable protect\_from\_forgery for uploads if  
you pass your session data to Uploadify, then back to Rails when you  
do the upload. But for the time being, disabling protect\_from\_forgery  
is the only way I’ve been able to get Uploadify to work too.

2. In order to insert middleware in Rails 3, add the following to  
config/application.rb:

config.middleware.insert\_before(ActionDispatch::Session::CookieStore,  
FlashSessionCookieMiddleware, ActionController::Base.session[:key])

However, ActionController::Base.session[:key] is no longer where  
session information is stored. I’ve tried accessing it with it with  
Rails.application.config.session\_store[:key], looked through the  
source and docs.

How do you access the session data in Rails 3?

Thanks, Patrick

On Feb 8, 11:24 pm, bshelton229 [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![bshelton229](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/90ced4/32.png) [@bshelton229](https://www.ruby-forum.com/u/bshelton229)\
**Post date:** [May 18, 2010, 6:45pm UTC](https://www.ruby-forum.com/t/rails3-pre-and-protect-from-forgery/183164/4 "2010-05-18T18:45:00Z")

</div>

Chaps,  
Does anyone know if a bug got filed for this issue?

Regards,  
Tom

---

<div class="post-metadata">

**Author:** ![bshelton229](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/90ced4/32.png) [@bshelton229](https://www.ruby-forum.com/u/bshelton229)\
**Post date:** [May 18, 2010, 7:54pm UTC](https://www.ruby-forum.com/t/rails3-pre-and-protect-from-forgery/183164/5 "2010-05-18T19:54:41Z")

</div>

No idea, sorry. Think I just ended up hacking the session key with a  
global variable.