# Unable to deactivate forgery protection

**URL:** <https://www.ruby-forum.com/t/unable-to-deactivate-forgery-protection/167245>\
**Category:** Rails\
**Created:** [May 5, 2009, 10:14pm UTC](https://www.ruby-forum.com/t/unable-to-deactivate-forgery-protection/167245 "2009-05-05T22:14:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![fipa](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/9e8a1a/32.png) [@fipa](https://www.ruby-forum.com/u/fipa)\
**Post date:** [May 5, 2009, 10:14pm UTC](https://www.ruby-forum.com/t/unable-to-deactivate-forgery-protection/167245/1 "2009-05-05T22:14:58Z")

</div>

Hi,

I just created a new Rails app that will be receiving some POSTed data  
from the outside so it must skip the verify\_authenticity\_token for some  
create actions. Although I have added:  
skip\_before\_filter :verifiy\_authenticity\_token

I still get InvalidAuthenticityToken. In one of my other Rails app  
(created back in Rails 1.2.6 and updated to 2.3.2 over time) this  
skipping works perfectly though, has anything changed since? Do I need  
to do anything more?

Thanks.

---

<div class="post-metadata">

**Author:** ![fipa](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/9e8a1a/32.png) [@fipa](https://www.ruby-forum.com/u/fipa)\
**Post date:** [May 5, 2009, 10:39pm UTC](https://www.ruby-forum.com/t/unable-to-deactivate-forgery-protection/167245/2 "2009-05-05T22:39:26Z")

</div>

can you try

protect\_from\_forgery :except =\> [:create, :other\_task]

On May 5, 1:14 pm, Fernando P. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![fipa](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/9e8a1a/32.png) [@fipa](https://www.ruby-forum.com/u/fipa)\
**Post date:** [May 6, 2009, 8:14am UTC](https://www.ruby-forum.com/t/unable-to-deactivate-forgery-protection/167245/3 "2009-05-06T08:14:16Z")

</div>

> I’m assuming that the above is not a cut-and-paste from the app?  
> Because “verify” is misspelled.  
> Magnificent catch! I would not have been able to spot it by myself!

Thank you Freddy and C.R.O. for your time 🙂

---

<div class="post-metadata">

**Author:** ![fipa](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/9e8a1a/32.png) [@fipa](https://www.ruby-forum.com/u/fipa)\
**Post date:** [May 5, 2009, 10:46pm UTC](https://www.ruby-forum.com/t/unable-to-deactivate-forgery-protection/167245/4 "2009-05-05T22:46:27Z")

</div>

On May 5, 2009, at 2:14 PM, Fernando P. wrote:

> Although I have added:  
> skip\_before\_filter :verifiy\_authenticity\_token

Fernando,

I’m assuming that the above is not a cut-and-paste from the app?  
Because “verify” is misspelled.

–cro