ActionController::InvalidAuthenticityToken

by

I had the same issue but with pages which were page cached. Pages got buffered with a stale authenticity token and all actions using the methods post/put/delete where recognized as forgery attempts. Error (422 Unprocessable Entity) was returned to the user.

The solution for Rails 3:
Add:

 skip_before_filter :verify_authenticity_token

or as “sagivo” pointed out in Rails 4 add: 

 skip_before_action :verify_authenticity_token

On pages which do caching.

As @toobulkeh commented this is not a vulnerability on :index, :show actions, but beware using this on :put, :post actions.

For example:

 caches_page :index, :show  
 skip_before_filter :verify_authenticity_token, :only => [:index, :show]

Reference: http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html

Note added by barlop- Rails 4.2 deprecated skip_before_filter in favour of skip_before_action https://guides.rubyonrails.org/4_2_release_notes.html “The *_filter family of methods have been removed from the documentation. Their usage is discouraged in favor of the *_action family of methods”

For Rails 6 (as “collimarco” pointed out) you can use skip_forgery_protection and that it is safe to use it for a REST API that doesn’t use session data.

More Related Contents:

  1. Explain like I'm LITERALLY five…what does it mean to "format" a string? [closed]
  2. How to change default timezone for Active Record in Rails?
  3. Why can you not have a foreign key in a polymorphic association?
  4. Passing parameters in rails redirect_to
  5. Change a Rails application to production
  6. Convert a Ruby on Rails app from sqlite to MySQL?
  7. ruby-debug with Ruby 1.9.3?
  8. in rails, how to return records as a csv file
  9. Rails 3 submit a form with multiple records
  10. Getting fields_for and accepts_nested_attributes_for to work with a belongs_to relationship
  11. Ruby-on-Rails: Multiple has_many :through possible?
  12. Rails 3 UTF-8 query string showing up in URL?
  13. How to display the time in user’s timezone
  14. how to add records to has_many :through association in rails
  15. Convert UTC to local time in Rails 3
  16. Rails Paperclip how to delete attachment?
  17. Scope with join on :has_many :through association
  18. Rails: “BCrypt::Errors::InvalidHash” when trying to sign in
  19. Rails form_for :remote=>true is not calling js method
  20. Remote mysql database on Heroku app
  21. Can nginx be used as a reverse proxy for a backend websocket server?
  22. Ruby on Rails – Validate a Cost
  23. How to implement bulk insert in Rails 3
  24. String.force_encoding() in Ruby 1.8.7 (or Rails 2.x)
  25. Ruby on Rails Callback, what is difference between :before_save and :before_create?
  26. Rails devise: user_signed_in? not working
  27. Ruby on Rails: Advanced search
  28. An error occurred while installing pg (0.17.1), and Bundler cannot continue
  29. ImageMagick – “CORE_RL_magick_.dll not found” or how to install RMagick on windows with ruby 1.9.2
  30. Rails Object Relationships and JSON Rendering

Leave a Comment