# Upgrade to 2.0.2: InvalidAuthenticityToken error on 1st POST **URL:** \ **Category:** Rails\ **Created:** [March 19, 2008, 6:17pm UTC](https://www.ruby-forum.com/t/upgrade-to-2-0-2-invalidauthenticitytoken-error-on-1st-post/132398 "2008-03-19T18:17:49Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![weyus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7ab992/32.png) [@weyus](https://www.ruby-forum.com/u/weyus)\ **Post date:** [March 19, 2008, 6:17pm UTC](https://www.ruby-forum.com/t/upgrade-to-2-0-2-invalidauthenticitytoken-error-on-1st-post/132398/1 "2008-03-19T18:17:49Z")
All, I’ve upgraded to 2.0.2, and I can’t get my login screen (the first POST request in the application) to work. When I post this form, I see the “InvalidAuthenticityToken” error. I have protect\_from\_forgery :secret =\> ‘my\_secret’ set in application.rb and I am using an active\_record session store based on this line in environment.rb: config.action\_controller.session\_store = :active\_record\_store My login\_form is generated using form\_for(). However, I am using text\_field\_tag and password\_field\_tag to generate the form fields inside of this form, so the form is not truly bound to an object like most Rails forms. I can see that my login form is posting the hidden authenticity\_token. And I can also see that the value of the “autheticity\_token” parameter is definitely not the same secret as “my\_secret” specified in the call to protect\_from\_forgery. So the error makes sense in that respect. I was under the impression that the protect\_from\_forgery call would embed the secret provided into the forms generated by Rails? Is that the correct understanding? Is there something else that I need to be doing in order to make the protect\_from\_forgery feature work? Thanks, Wes ---
**Author:** ![weyus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7ab992/32.png) [@weyus](https://www.ruby-forum.com/u/weyus)\ **Post date:** [March 19, 2008, 6:23pm UTC](https://www.ruby-forum.com/t/upgrade-to-2-0-2-invalidauthenticitytoken-error-on-1st-post/132398/2 "2008-03-19T18:23:21Z")
Wes G. wrote: > All, > > I’ve upgraded to 2.0.2, and I can’t get my login screen (the first POST > request in the application) to work. > > When I post this form, I see the “InvalidAuthenticityToken” error. > > I have > > protect\_from\_forgery :secret =\> ‘my\_secret’ > > set in application.rb > > and I am using an active\_record session store based on this line in > environment.rb: > Is there something else that I need to be doing in order to make the > protect\_from\_forgery feature work? > > Thanks, > Wes check controllers/application.rb class ApplicationController \< ActionController::Base helper :all # include all helpers, all the time # See ActionController::RequestForgeryProtection for details # Uncomment the :secret if you’re not using the cookie session store protect\_from\_forgery # :secret =\> ‘3218a694a55a785a0cbedf86a388f8bf’ end Note the remarks about not using the cookie session store. ---
**Author:** ![weyus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7ab992/32.png) [@weyus](https://www.ruby-forum.com/u/weyus)\ **Post date:** [March 19, 2008, 9:29pm UTC](https://www.ruby-forum.com/t/upgrade-to-2-0-2-invalidauthenticitytoken-error-on-1st-post/132398/3 "2008-03-19T21:29:02Z")
James, I had the secret uncommented and saw the behavior that I described. Wes ---
**Author:** ![weyus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7ab992/32.png) [@weyus](https://www.ruby-forum.com/u/weyus)\ **Post date:** [March 20, 2008, 12:49am UTC](https://www.ruby-forum.com/t/upgrade-to-2-0-2-invalidauthenticitytoken-error-on-1st-post/132398/4 "2008-03-20T00:49:02Z")
On Wed, Mar 19, 2008 at 10:23 AM, James B. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > Thanks, > > Wes You need to be sending the token with each form post. The form\_tag block method should add it for you. Also, your sessions need to be working. You’ll know it’s good if neither your session id or form auth token change on each refresh. You can check this looking at the development log and the source of the form (the auth token should be in a hidden field). [http://rails.rubyonrails.org/classes/ActionController/RequestForgeryProtection.html#M000296](http://rails.rubyonrails.org/classes/ActionController/RequestForgeryProtection.html#M000296) – Rick O. [http://lighthouseapp.com](http://lighthouseapp.com) [http://weblog.techno-weenie.net](http://weblog.techno-weenie.net) [http://mephistoblog.com](http://mephistoblog.com) ---
**Author:** ![weyus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7ab992/32.png) [@weyus](https://www.ruby-forum.com/u/weyus)\ **Post date:** [March 20, 2008, 1:00am UTC](https://www.ruby-forum.com/t/upgrade-to-2-0-2-invalidauthenticitytoken-error-on-1st-post/132398/5 "2008-03-20T01:00:59Z")
Rick, Thanks. As it turns out, my sessions weren’t working for this other reason ([Is anyone running Rails 2.x against a MS SQL Server DB? - Rails - Ruby-Forum](http://www.ruby-forum.com/topic/146066)) that has me digging around in the ActiveRecord transactions code ([Object\_transactions plugin w/2.x disables AR session store - Rails - Ruby-Forum](http://www.ruby-forum.com/topic/146569)). Once I get my sessions working, I will give it another shot. Wes ---
**Author:** ![weyus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7ab992/32.png) [@weyus](https://www.ruby-forum.com/u/weyus)\ **Post date:** [April 19, 2008, 10:50am UTC](https://www.ruby-forum.com/t/upgrade-to-2-0-2-invalidauthenticitytoken-error-on-1st-post/132398/6 "2008-04-19T10:50:07Z")
could you try to include prototype in your layout? It’s work for me 🙂 ---
**Author:** ![weyus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7ab992/32.png) [@weyus](https://www.ruby-forum.com/u/weyus)\ **Post date:** [April 19, 2008, 4:49pm UTC](https://www.ruby-forum.com/t/upgrade-to-2-0-2-invalidauthenticitytoken-error-on-1st-post/132398/7 "2008-04-19T16:49:47Z")
On 20 mar, 01:48, “Rick O.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > request in the application) to work. > > > environment.rb: > > > auth token change on each refresh. You can check this looking at the > > > development log and the source of the form (the auth token should be > > > in a hidden field). > > [http://rails.rubyonrails.org/classes/ActionController/RequestForgeryP](http://rails.rubyonrails.org/classes/ActionController/RequestForgeryP)… > > – > Rick O.[http://lighthouseapp.comhttp](http://lighthouseapp.comhttp)://weblog.techno-weenie.nethttp://mephistoblog.com I’m using restful\_authentication plugin and I found that if you delete the cookies before submitting in the login form and then you log in, you get the exception: “ActionController::InvalidAuthenticityToken in SessionsController#create”. Any idea to fix this? Thanks! ---
**Author:** ![weyus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7ab992/32.png) [@weyus](https://www.ruby-forum.com/u/weyus)\ **Post date:** [April 19, 2008, 9:23pm UTC](https://www.ruby-forum.com/t/upgrade-to-2-0-2-invalidauthenticitytoken-error-on-1st-post/132398/8 "2008-04-19T21:23:24Z")
> I’m using restful\_authentication plugin and I found that if you delete > the cookies before submitting in the login form and then you log in, > you get the exception: “ActionController::InvalidAuthenticityToken in > SessionsController#create”. > > Any idea to fix this? > > Thanks! 1. Don’t clear your cookies when you are on the login screen. OR 2. Don’t use the default cookie session store. Rails by default uses cookies to store the sessions so when you essentially clear your cookies while you are the login screen it clears all the information about the session and then thinks its a forgery attempt.