# ActionController::InvalidAuthenticityToken in LoginController

**URL:** <https://discuss.rubyonrails.org/t/actioncontroller-invalidauthenticitytoken-in-logincontroller/23294>\
**Category:** rubyonrails-talk\
**Created:** [January 16, 2008, 2:45am UTC](https://discuss.rubyonrails.org/t/actioncontroller-invalidauthenticitytoken-in-logincontroller/23294 "2008-01-16T02:45:39Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Double](https://avatars.discourse-cdn.com/v4/letter/d/8baadc/32.png) [@Double](https://discuss.rubyonrails.org/u/Double)\
**Post date:** [January 16, 2008, 2:45am UTC](https://discuss.rubyonrails.org/t/actioncontroller-invalidauthenticitytoken-in-logincontroller/23294/1 "2008-01-16T02:45:39Z")

</div>

Hi,

I'm having a problem trying to get a login controller working. When I try and post to my login controller I get the following error:

ActionController::InvalidAuthenticityToken in LoginController#login

login\_controller:

class LoginController \< ApplicationController def login &nbsp;&nbsp;&nbsp;&nbsp;case request.method &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;when :post &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if @session['user'] = User.authenticate(@params['username'], @params['password'])

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;flash['notice'] = "Login successful" &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;redirect\_back\_or\_default :action =\> "welcome" &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;else &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;@login = @params['username'] &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;@message = "Login unsuccessful" &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;redirect\_to :action=\> "login" &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;end &nbsp;&nbsp;&nbsp;&nbsp;end &nbsp;&nbsp;end .....

login.html.erb:

&nbsp;&nbsp;\<div id="login"\> &nbsp;&nbsp;&nbsp;&nbsp;\<h1\>Please Login\</h1\>

&nbsp;&nbsp;&nbsp;&nbsp;\<form method="post" action=""\> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\<p\>\<label for="user\_login"\>Username\</label\> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\<%= text\_field "user", "username", :class =\> 'textbox', :value =\> '', :maxlength =\> 40 %\>\</p\> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\<p\>\<label for="user\_password"\>Password\</label\> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\<%= password\_field "user", "password", :class =\> 'textbox', :value =\> '', :maxlength =\> 40 %\>\</p\> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\<p class="buttons"\> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\<%= submit\_tag 'Login', :class =\> 'button' %\> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\</p\> &nbsp;&nbsp;&nbsp;&nbsp;\</form\> \</div\>

User.rb

class User \< ActiveRecord::Base

&nbsp;&nbsp;def self.authenticate(login, pass) &nbsp;&nbsp;&nbsp;&nbsp;User.find(:first, :conditions =\>["username = ? AND password = ?", login, sha1(pass)]) &nbsp;&nbsp;end

&nbsp;&nbsp;def change\_password(pass) &nbsp;&nbsp;&nbsp;&nbsp;update\_attribute "password", self.class.sha1(pass) &nbsp;&nbsp;end

&nbsp;&nbsp;protected

&nbsp;&nbsp;def self.sha1(pass) &nbsp;&nbsp;&nbsp;&nbsp;Digest::SHA1.hexdigest("somedigest") &nbsp;&nbsp;end

&nbsp;&nbsp;before\_create :crypt\_password

&nbsp;&nbsp;def crypt\_password &nbsp;&nbsp;&nbsp;&nbsp;write\_attribute("password", self.class.sha1(password)) &nbsp;&nbsp;end

&nbsp;&nbsp;validates\_length\_of :login, :within =\> 3..40 &nbsp;&nbsp;validates\_length\_of :password, :within =\> 5..40 &nbsp;&nbsp;validates\_presence\_of :login, :password, :password\_confirmation &nbsp;&nbsp;validates\_uniqueness\_of :login, :on =\> :create &nbsp;&nbsp;validates\_confirmation\_of :password, :on =\> :create end

I have the :secret and :session\_key set in the environment.rb

Does anyone have any ideas?

---

<div class="post-metadata">

**Author:** ![Jean-Francois\_Tran](https://avatars.discourse-cdn.com/v4/letter/j/c89c15/32.png) [@Jean-Francois\_Tran](https://discuss.rubyonrails.org/u/Jean-Francois_Tran)\
**Post date:** [January 16, 2008, 3:15am UTC](https://discuss.rubyonrails.org/t/actioncontroller-invalidauthenticitytoken-in-logincontroller/23294/2 "2008-01-16T03:15:30Z")

</div>

> I'm having a problem trying to get a login controller working. When I try and post to my login controller I get the following error:
> 
> ActionController::InvalidAuthenticityToken in LoginController#login

[...]

> login.html.erb:
> 
> &nbsp;&nbsp;\<div id="login"\> &nbsp;&nbsp;&nbsp;&nbsp;\<h1\>Please Login\</h1\>
> 
> &nbsp;&nbsp;&nbsp;&nbsp;\<form method="post" action=""\> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\<p\>\<label for="user\_login"\>Username\</label\> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\<%= text\_field "user", "username", :class =\> 'textbox', :value =\> '', :maxlength =\> 40 %\>\</p\> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\<p\>\<label for="user\_password"\>Password\</label\> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\<%= password\_field "user", "password", :class =\> 'textbox', :value =\> '', :maxlength =\> 40 %\>\</p\> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\<p class="buttons"\> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\<%= submit\_tag 'Login', :class =\> 'button' %\> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\</p\> &nbsp;&nbsp;&nbsp;&nbsp;\</form\> \</div\>

You should use the token\_tag helper in your form to provide the secret token needed by Rails for CSRF security reasons.

&nbsp;&nbsp;&nbsp;-- Jean-François.

---

<div class="post-metadata">

**Author:** ![Double](https://avatars.discourse-cdn.com/v4/letter/d/8baadc/32.png) [@Double](https://discuss.rubyonrails.org/u/Double)\
**Post date:** [January 16, 2008, 3:22am UTC](https://discuss.rubyonrails.org/t/actioncontroller-invalidauthenticitytoken-in-logincontroller/23294/3 "2008-01-16T03:22:13Z")

</div>

Are you saying that is the problem or are you making that suggestion for simply security reasons?

---

<div class="post-metadata">

**Author:** ![Double](https://avatars.discourse-cdn.com/v4/letter/d/8baadc/32.png) [@Double](https://discuss.rubyonrails.org/u/Double)\
**Post date:** [January 16, 2008, 3:32am UTC](https://discuss.rubyonrails.org/t/actioncontroller-invalidauthenticitytoken-in-logincontroller/23294/4 "2008-01-16T03:32:31Z")

</div>

Forget it - got it. Thank you for the help. This worked like a charm.

\<%= token\_tag %\>

---

<div class="post-metadata">

**Author:** ![Bzouchir](https://avatars.discourse-cdn.com/v4/letter/b/b5ac83/32.png) [@Bzouchir](https://discuss.rubyonrails.org/u/Bzouchir)\
**Post date:** [January 21, 2008, 10:33am UTC](https://discuss.rubyonrails.org/t/actioncontroller-invalidauthenticitytoken-in-logincontroller/23294/5 "2008-01-21T10:33:22Z")

</div>

HI I'm having that same exact problem while following "rails solutions" book excercises.

the difference is that I'm still new to RoR that i couldn't get it to work with \<%= token\_tag %\> didn't find much on the net either.

where should i add this tag and how is it used? is there any extra params to add to it?

in my view I have: \<%= form\_tag({:controller =\> 'user', :action =\> 'login'},{:id =\>"login\_form"})%\> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\<label for="user\_login"\>Login:\</label\>\<br /\> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\<%= text\_field :user, :login %\>\<br /\> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\<label for="user\_login"\>Password:\</label\>\<br /\> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\<%= password\_field :user, :password%\>\<br /\> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\<%= submit\_tag 'Login' %\> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\<% $end %\>

this happened after I uncommented in environment.rb and restarted the server config.action\_controller.session\_store = :active\_record\_store

if it worked for you please help me out on that one. cheers.