# REST Web Service ActionController::InvalidAuthenticityToken

**URL:** <https://www.ruby-forum.com/t/rest-web-service-actioncontroller-invalidauthenticitytoken/126255>\
**Category:** Rails\
**Created:** [January 16, 2008, 7:51pm UTC](https://www.ruby-forum.com/t/rest-web-service-actioncontroller-invalidauthenticitytoken/126255 "2008-01-16T19:51:16Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kadoudal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/f0a364/32.png) [@kadoudal](https://www.ruby-forum.com/u/kadoudal)\
**Post date:** [January 16, 2008, 7:51pm UTC](https://www.ruby-forum.com/t/rest-web-service-actioncontroller-invalidauthenticitytoken/126255/1 "2008-01-16T19:51:16Z")

</div>

I am trying to write a REST web service

testing locally is fine but whane I deploy the server and try test it  
via curl

curl -i -X POST -H ‘Content-Type:application/xml’ -d ‘’  
[http://mytesteddomain.tld/user/posts/createReference.xml](http://mytesteddomain.tld/user/posts/createReference.xml)

I get an error :

ERROR TYPE: ActionController::InvalidAuthenticityToken

ERROR MESSAGE: ActionController::InvalidAuthenticityToken

I don’t have any protection in my app as I put a filter to avoid the  
login check  
before\_filter :login\_required, :except =\> [:createReference]

my Apache vhost.conf doesn’t block :

\<Directory “/var/rails/mytesteddomainname/current/public”\>  
Options FollowSymLinks  
AllowOverride None  
Order allow,deny  
Allow from all

where should I start looking for ?

thansk for your help

---

<div class="post-metadata">

**Author:** ![kadoudal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/f0a364/32.png) [@kadoudal](https://www.ruby-forum.com/u/kadoudal)\
**Post date:** [February 11, 2008, 2:14pm UTC](https://www.ruby-forum.com/t/rest-web-service-actioncontroller-invalidauthenticitytoken/126255/2 "2008-02-11T14:14:38Z")

</div>

hi,  
I’m having the exact same problem. Do you have a solution already -  
would be cool to know!! 🙂

kind regards,  
Alfons

On Jan 16, 7:51 pm, Kad K. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)