# Sending vars from Flash to Rails - how to use auth\_token

**URL:** <https://www.ruby-forum.com/t/sending-vars-from-flash-to-rails-how-to-use-auth-token/168366>\
**Category:** Rails\
**Created:** [May 20, 2009, 12:33am UTC](https://www.ruby-forum.com/t/sending-vars-from-flash-to-rails-how-to-use-auth-token/168366 "2009-05-20T00:33:30Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [May 20, 2009, 12:33am UTC](https://www.ruby-forum.com/t/sending-vars-from-flash-to-rails-how-to-use-auth-token/168366/1 "2009-05-20T00:33:30Z")

</div>

OK I finally am able to get a filereference uploader to send files to  
rails from Flash. I had to turn the auth\_token off using:

skip\_before\_filter :verify\_authenticity\_token, :only =\> ‘upload\_photo’

But, for security I want to turn it back on. But I’m unable to get  
Flash to send the vars correctly. I am able to grab the auth token  
with some Javascript and I then use:

variables = new URLVariables();  
variables.authenticity\_token = paramList[“authenticityToken”];  
var request = new URLRequest(UPLOAD\_URL);  
request.method = URLRequestMethod.POST;  
request.data = variables;

Is that correct? The variable in an html rails form uses the same var  
“authenticity\_token” so I would assume it’s the same, but it’s not  
working.

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [May 20, 2009, 2:28am UTC](https://www.ruby-forum.com/t/sending-vars-from-flash-to-rails-how-to-use-auth-token/168366/2 "2009-05-20T02:28:43Z")

</div>

I think you’re on the right track; we use:

```
        request=new URLRequest("/line_items");
        request.method=URLRequestMethod.POST;

```

request.data=“authenticity\_token=”+authenticity\_token+"&design\_id="+id;  
loader.load(request);

One gotcha I ran into is authenticity\_tokens are not URI-safe, which was  
causing intermittent failures for me depending on the value of a given  
authenticity\_token. So when I’m pulling it from the flashvars I do:

var  
authenticity\_token:String=encodeURIComponent(parameters[“authenticity\_token”]);

Glancing at the doc for URLVariables, I don’t _think_ it does that for  
you; you need to do it yourself.

HTH,

dwh

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [May 20, 2009, 8:20am UTC](https://www.ruby-forum.com/t/sending-vars-from-flash-to-rails-how-to-use-auth-token/168366/3 "2009-05-20T08:20:22Z")

</div>

Hmm, I tried doing:

request.data = “authenticity\_token=”+paramList[“authenticityToken”]  
+"&design\_id=1";

instead of variables, and still nothing. One thing I did notice… I  
made a dynamic field on the stage and put the auth\_code in there to  
see if it was working. I’m not sure why, but for some reason the field  
won’t include any + signs. there’s spaces there, and when I look in  
the form field in html on the same page I have my flash, the spaces  
are + signs. Not sure if that’s a reason…

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [May 20, 2009, 1:10pm UTC](https://www.ruby-forum.com/t/sending-vars-from-flash-to-rails-how-to-use-auth-token/168366/4 "2009-05-20T13:10:34Z")

</div>

I had discussed that in my previous reply. You need to URI-encode the  
authenticity\_token before sending it back.

dwh

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [May 20, 2009, 2:24pm UTC](https://www.ruby-forum.com/t/sending-vars-from-flash-to-rails-how-to-use-auth-token/168366/5 "2009-05-20T14:24:32Z")

</div>

It still won’t work. This issue has been discussed in the past (I know  
cos I participated in it and provided a nice course of action to get  
it working :-)).

[http://www.ruby-forum.com/topic/161291](http://www.ruby-forum.com/topic/161291)

The post is about integrating SWFUpload with Rails and pass it on to  
attachment\_fu, but variants such as custom Flash uploaders and  
Paperclip instead of attachment\_fu should be easy to deduce from my  
information.

On 20 May 2009, at 13:09, Denis H. wrote:

> > instead of variables, and still nothing. One thing I did notice… I  
> > made a dynamic field on the stage and put the auth\_code in there to  
> > see if it was working. I’m not sure why, but for some reason the  
> > field  
> > won’t include any + signs. there’s spaces there, and when I look in  
> > the form field in html on the same page I have my flash, the spaces  
> > are + signs. Not sure if that’s a reason…

Best regards

Peter De Berdt

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [May 20, 2009, 8:47pm UTC](https://www.ruby-forum.com/t/sending-vars-from-flash-to-rails-how-to-use-auth-token/168366/6 "2009-05-20T20:47:45Z")

</div>

Okay, I was talking about the general case of Flash talking to Rails,  
not about file uploading in specific.

What I did works for me 😉

dwh