# Token\_tag Madness! Or how do I get my pre 2.x code to work again

**URL:** <https://www.ruby-forum.com/t/token-tag-madness-or-how-do-i-get-my-pre-2-x-code-to-work-again/126260>\
**Category:** Rails\
**Created:** [January 16, 2008, 8:38pm UTC](https://www.ruby-forum.com/t/token-tag-madness-or-how-do-i-get-my-pre-2-x-code-to-work-again/126260 "2008-01-16T20:38:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![DrSVanderdecken](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ecae2f/32.png) [@DrSVanderdecken](https://www.ruby-forum.com/u/DrSVanderdecken)\
**Post date:** [January 16, 2008, 8:38pm UTC](https://www.ruby-forum.com/t/token-tag-madness-or-how-do-i-get-my-pre-2-x-code-to-work-again/126260/1 "2008-01-16T20:38:41Z")

</div>

I have an HTML MAP over laying some video so i can control aPTZ camera  
through my server code. The camera is not visible outside the network  
so i want to control access to it.

 \<area shape="rect" coords="60,0,180,45" ....

The above code is generate by some ruby code in the model area.rb

models/area.rb

def createArea()  
for a in @areas

```
 line = "<area shape=\"#{a.shape}\" coords=

```

“#{a.x},#{a.y},#{a.x2},#{a.y2}”  
onclick=“new Ajax.Request(’/page/  
moveCamera\_#{a.command}?ip=#{ip}’, {asynchronous:true,  
evalScripts:true})” \> "  
lines[i] = line  
i = i + 1  
end  
…  
end

The above code worked just fine. But with the new token\_tag stuff it  
won’t work and I don’t have a clue how to make it work.

My question is where to I put the the “token\_tag” stuff to create the  
token so Rails won’t reject the request? I generate the code within  
the area.rb so the model has control over the data it gets from the  
database.

I really don’t want to create new “rails” functions or override stuff  
that will get outdated in the next Rails release. I just want to know  
how to fix my Ajax.Request() line so my code will work again.

I know it has something to do with “:url =\>  
token\_tag\_nightmare\_additons” in Ajax.Request or i need to create  
remote\_function with it. But this code works and if I remember  
correctly it was hard enough to get it work the first time.

(Please just help. And try to be specific as you can. Hand waving does  
not actually help nor does a lecture on why dont I do it the the  
“Rails Form way”. As of this point I am so fustrated with the  
2.0.death Rails release that I feel like dumping my 2 years worth of  
work in ROR and rewritting it in PHP.)

((Yes, i have every imaginable book on ROR in my library here, so if  
you can cite a specific page in a Book that would be great too.))

And yes, i do have it working with the old code by turning off the  
securty  
skip\_before\_filter :verify\_authenticity\_token

---

<div class="post-metadata">

**Author:** ![DrSVanderdecken](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ecae2f/32.png) [@DrSVanderdecken](https://www.ruby-forum.com/u/DrSVanderdecken)\
**Post date:** [January 16, 2008, 9:04pm UTC](https://www.ruby-forum.com/t/token-tag-madness-or-how-do-i-get-my-pre-2-x-code-to-work-again/126260/2 "2008-01-16T21:04:51Z")

</div>

2008/1/16, Dr. Vanderdecken [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> I have an HTML MAP over laying some video so i can control  
> aPTZ camera through my server code. The camera is not  
> visible outside the network so i want to control access to it.

[lots of ugliness stripped]

If you really want to put that code smell in your model, it’s up  
to you, but then don’t complain it will not work with future  
Rails versions.

If you want to do a mess between models and views,  
then do it, but don’t complain it’s Rails fault.

See in #options\_for\_ajax method in prototype\_helper.rb, how  
CSRF stuff is handled in Ajax :

if protect\_against\_forgery? && !options[:form]  
if js\_options[‘parameters’]  
js\_options[‘parameters’] \<\< " + ‘&"  
else  
js\_options[‘parameters’] = "’"  
end  
js\_options[‘parameters’] \<\< "#{request\_forgery\_protection\_token}=’

- encodeURIComponent(‘#{escape\_javascript form\_authenticity\_token}’)"  
end

A helper would be a better place to put all your code…

– Jean-François.