# Token\_tag not generated

**URL:** <https://www.ruby-forum.com/t/token-tag-not-generated/127981>\
**Category:** Rails\
**Created:** [February 3, 2008, 7:54pm UTC](https://www.ruby-forum.com/t/token-tag-not-generated/127981 "2008-02-03T19:54:25Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![andy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/aeb1de/32.png) [@andy](https://www.ruby-forum.com/u/andy)\
**Post date:** [February 3, 2008, 7:54pm UTC](https://www.ruby-forum.com/t/token-tag-not-generated/127981/1 "2008-02-03T19:54:25Z")

</div>

I’m using Rails2.0.2 and I’d like to use against CSRF feature in my  
form.  
This form is generated from the controller using partial rendering.

def commentform destination=""  
render :partial=\>‘forms/commentform’, :locals =\>  
{ :url=\>destination }  
end

and commentform looks like this  
\<% form\_tag(:controller=\>‘comments’, :action=\>‘create’) do %\>

 \<%= token\_tag %\>

```
<label for="nucleus_cf_body"><%= text("_COMMENTFORM_COMMENT") %></

```

label\>  
\<%= text\_area :comment, :cbody, “cols” =\> 40, “rows” =\> 10 %\>

```
<label for="nucleus_cf_name"><%= text("_COMMENTFORM_NAME") %></

```

label\>  
\<%= text\_field :comment, :cname, “size”=\>40 %\>

```
<label for="nucleus_cf_mail"><%= text("_COMMENTFORM_MAIL") %></

```

label\>  
\<%= text\_field :comment, :cmail, “size”=\>40, “maxlength”=\>80 %\>\<br /

> 

```
<label for="nucleus_cf_email"><%= text("_COMMENTFORM_EMAIL") %></

```

label\>  
\<%= text\_field :comment, :cemail, “size”=\>40, “maxlength”=\>60 %\>\<br  
/

> 

```
<%= check_box_tag("remember", value = "1", checked = false) %>
<label for="nucleus_cf_remember"><%= text("_COMMENTFORM_REMEMBER")

```

%\>

```
<%= submit_tag(text("_COMMENTFORM_SUBMIT")) %>

```

\<% end %\>

but token\_tag doesn’t produce any tag, and I get  
InvalidAuthenticityToken error.  
I tried to debug and found that protect\_against\_forgery? returns  
false.  
I tested the method from the controller but at that time it returned  
true.  
What should I do to generate the token?

---

<div class="post-metadata">

**Author:** ![andy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/aeb1de/32.png) [@andy](https://www.ruby-forum.com/u/andy)\
**Post date:** [February 4, 2008, 2:51pm UTC](https://www.ruby-forum.com/t/token-tag-not-generated/127981/2 "2008-02-04T14:51:53Z")

</div>

You can use @form\_authenticity\_token to get the value that should be  
passed. You can either embed it in the url  
(:authenticity\_token=\>@form\_authenticity\_token) or play around adding  
it as a hidden\_field. You might also investigate using form\_for  
instead of form\_tag; I think it automatically includes the  
authenticity token for you.

The different results from protect\_against\_forgery makes sense  
depending on how you did your testing. It only requires the  
authenticity token when it’s processing an html submitted form.