How do I make forms work with no javascript enabled? (ActionController::InvalidAuthenticityToken)

[Yuri Kanivetsky]

Hi,

I've got some basic form:

    <%= form_for(@task, remote: true, html: {'data-type' => 'html'}) do |f| %>

      <%= f.text_field :text %>

      <%= f.submit %>

    <% end %>

But when I submit it with no javascript enabled, I get:

    Started POST "/tasks" for ::1 at 2015-02-02 23:38:27 +0200

    Processing by TasksController#create as HTML

      Parameters: {"utf8"=>"✓", "task"=>{"text"=>"adsf"}, "commit"=>"Create Task"}

    Can't verify CSRF token authenticity

    Completed 422 Unprocessable Entity in 5ms

    ActionController::InvalidAuthenticityToken (ActionController::InvalidAuthenticityToken):

      actionpack (4.2.0) lib/action_controller/metal/request_forgery_protection.rb:181:in `handle_unverified_request'

    ...

How do I remedy this?

Regards,

Yuri

[amruby]

Can you try like this <%= form_for(@task, remote: true, authenticity_token: true,  html: {'data-type' => 'html'}) do |f| %>

Thanks

Vishnu

[Yuri Kanivetsky]

Can you try like this <%= form_for(@task, remote: true, authenticity_token: true,  html: {'data-type' => 'html'}) do |f| %>

 

Yep, that pretty much settles it.

Regards,

Yuri 

[tamouse pontiki]

Yuri,

You may want to review protect_from_forgery: <http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html#method-i-protect_from_forgery>

--
You received this message because you are subscribed to the Google Groups "Ruby on Rails: Talk" group.
To unsubscribe from this group and stop receiving emails from it, send an email to rubyonrails-ta...@googlegroups.com.
To post to this group, send email to rubyonra...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/rubyonrails-talk/5fdcf62c-8c72-4498-9393-47f6a1d8e25e%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[Yuri Kanivetsky]

You may want to review protect_from_forgery: <http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html#method-i-protect_from_forgery>

I bet you must be meaning form_for, not protect_from_forgery.

Regards,

Yuri

[tamouse pontiki]

On Wed, Feb 4, 2015 at 5:49 AM, Yuri Kanivetsky <yuri.ka...@gmail.com> wrote:

You may want to review protect_from_forgery: <http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html#method-i-protect_from_forgery>

I bet you must be meaning form_for, not protect_from_forgery.

Ah, well, think what you like.