# ActionController::InvalidAuthenticityToken

**URL:** <https://discuss.rubyonrails.org/t/actioncontroller-invalidauthenticitytoken/24159>\
**Category:** rubyonrails-talk\
**Created:** [January 31, 2008, 7:45pm UTC](https://discuss.rubyonrails.org/t/actioncontroller-invalidauthenticitytoken/24159 "2008-01-31T19:45:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![11175](https://avatars.discourse-cdn.com/v4/letter/1/8edcca/32.png) [@11175](https://discuss.rubyonrails.org/u/11175)\
**Post date:** [January 31, 2008, 7:45pm UTC](https://discuss.rubyonrails.org/t/actioncontroller-invalidauthenticitytoken/24159/1 "2008-01-31T19:45:03Z")

</div>

I am new to RoR. I am running Linux Red Hat Enterprise with MySQL for my db, and when I go and either create/update the database I get this message:

ActionController::InvalidAuthenticityToken in Test1Controller#create(or update) ActionController::InvalidAuthenticityToken

I can destroy any of the items in the db, just can not create or update. The answer is probably simple, but I just have not found it yet...if more information is needed please let me know.

---

<div class="post-metadata">

**Author:** ![11175](https://avatars.discourse-cdn.com/v4/letter/1/8edcca/32.png) [@11175](https://discuss.rubyonrails.org/u/11175)\
**Post date:** [January 31, 2008, 10:03pm UTC](https://discuss.rubyonrails.org/t/actioncontroller-invalidauthenticitytoken/24159/2 "2008-01-31T22:03:06Z")

</div>

Hi Michael,

This article will explain what this error message is about. [http://ryandaigle.com/articles/2007/9/24/what-s-new-in-edge-rails-better-cross-site-request-forging-prevention](http://ryandaigle.com/articles/2007/9/24/what-s-new-in-edge-rails-better-cross-site-request-forging-prevention)

Hope this helps,

Scott

Michael Jubin wrote:

---

<div class="post-metadata">

**Author:** ![11155](https://avatars.discourse-cdn.com/v4/letter/1/d26b3c/32.png) [@11155](https://discuss.rubyonrails.org/u/11155)\
**Post date:** [January 13, 2010, 6:27am UTC](https://discuss.rubyonrails.org/t/actioncontroller-invalidauthenticitytoken/24159/3 "2010-01-13T06:27:50Z")

</div>

Michael Jubin wrote:

> I am new to RoR. I am running Linux Red Hat Enterprise with MySQL for my db, and when I go and either create/update the database I get this message:
> 
> ActionController::InvalidAuthenticityToken in Test1Controller#create(or update) ActionController::InvalidAuthenticityToken
> 
> I can destroy any of the items in the db, just can not create or update. The answer is probably simple, but I just have not found it yet...if more information is needed please let me know.

I added the lines :only =\> [:update, :delete, :create] after protect\_from\_forgery and things worked.

I'm on rails 2.3+