# REST web service POST 401 Unauthorized error

**URL:** <https://discuss.rubyonrails.org/t/rest-web-service-post-401-unauthorized-error/23347>\
**Category:** rubyonrails-talk\
**Created:** [January 16, 2008, 10:55pm UTC](https://discuss.rubyonrails.org/t/rest-web-service-post-401-unauthorized-error/23347 "2008-01-16T22:55:09Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Erwin1](https://avatars.discourse-cdn.com/v4/letter/e/d07c76/32.png) [@Erwin1](https://discuss.rubyonrails.org/u/Erwin1)\
**Post date:** [January 16, 2008, 10:55pm UTC](https://discuss.rubyonrails.org/t/rest-web-service-post-401-unauthorized-error/23347/1 "2008-01-16T22:55:09Z")

</div>

I am trying to set up REST web service w Rails 2.0.2,

I don't have any problem with the GET

url = "http://#{WWW\_HOST}/posts/online.xml" result = Net::HTTP.get(URI(url)) I get the expected result

but when I try to use a POST, url = URI.parse("http://#{WWW\_HOST}//user/posts/createReference.xml") .. post\_args1,...post\_args2.... resp, data = Net::HTTP.post\_form(url, {post\_args1, post\_args2} )

I get a 401 Unauthorized error (ERROR TYPE: ActionController::InvalidAuthenticityToken)

In my server PostsController, I have a filter , but I wrote : class PostsController \< ApplicationController before\_filter :login\_required, :except =\> [:online, :createReference] so the login is not required for both actions online and createReference

in my routes I have : map.resources :posts, :collection =\> {:online =\> :get} and &nbsp;&nbsp;map.resource :user, :controller =\> "users" do |user| &nbsp;&nbsp;&nbsp;&nbsp;user.resources :posts, :collection =\> {:createReference =\> :post } end

I know that AuthenticityToken is quite new with 2.0 and forms I am using

class ApplicationController \< ActionController::Base &nbsp;&nbsp;include AuthenticationSystem, &nbsp;&nbsp;&nbsp;&nbsp;protect\_from\_forgery

where should I start to investigate ?

thanks for your help