0

I'm following the rails getting started guide here: http://guides.rubyonrails.org/getting_started.html

I'm on the step 'Creating posts', where I setup my new view to submit a post to my controller. When I click the submit button in the view I get the error ActionController::InvalidAuthenticityToken

I was able to get past the error by commenting out this line in the ApplicationController

protect_from_forgery with: :exception

However I'm not sure if I should be doing that. Is that fine or should I dig deeper into the problem? What does that line do?

Content of: /views/layouts/application.html.erb

<!DOCTYPE html>
<html>
<head>
  <title>Budget</title>
  <%= stylesheet_link_tag    "application", media: "all", "data-turbolinks-track" => true %>
  <%= javascript_include_tag "application", "data-turbolinks-track" => true %>
  <%= csrf_meta_tags %>
</head>
<body>

<%= yield %>

</body>
</html>
user2246986
  • 1
  • 1
  • Did you remove the `<%= csrf_meta_tags %>` declaration from your layout file? – sevenseacat Feb 04 '14 at 05:49
  • No I did not modify the layout file at all, I updated my original post with the content of /views/layouts/application.html.erb. I just followed the getting started guide, instead of creating a Posts controller, I created a Purchases controller, and instead of rails new blog, I used rails new budget – user2246986 Feb 04 '14 at 22:17

1 Answers1

1

No, you shouldn't be commenting that line in your ApplicationController. It is meant for the security of your application at production level.

From the docs: Turn on request forgery protection. Bear in mind that only non-GET, HTML/JavaScript requests are checked.

protect_from_forgery is a feature in Rails that protects against Cross-site Request Forgery (CSRF) attacks. This feature makes all generated forms have a hidden id field. This id field must match the stored id or the form submission is not accepted. This prevents malicious forms on other sites or forms inserted with XSS from submitting to the Rails application. Shamelessly copied from here.

And, in last but not the least. Here is the link explaining why Cross-Site Request Forgery (CSRF) should be taken seriously, and why it is important.

Surya
  • 15,703
  • 3
  • 51
  • 74