Question

here my problem,

I’ve got a rails 3.1 app and I’m trying to make an ajax request but I get the warning message “WARNING: Can’t verify CSRF token authenticity”…

Inside my layout I’ve got the helper method “csrf_method_tag”, and I add the following javascript code (don’t know if it’s really required or not):

$.ajaxSetup({
  beforeSend: function(xhr) {
    xhr.setRequestHeader('X-CSRF-Token', $('meta[name="csrf-token"]').attr('content'));
  }
});

My Gemfile contains the gem jquery-rails (>= 1.0.12) and I require jquery & jquery-ujs at the top of my application.js.

Even with that, the message still appears. Did i forget something?

Thanks for you help.

Answer 1

What’s worked for me – when working without forms – is to include the result of <%= form_authenticity_token %> in the ajax data payload. So I do something like what was suggested by tehprofessor in the html:

<input id="tokentag" type="hidden" name="authenticity_token" value="<%= form_authenticity_token %>" />

then in the javascript:

tokentag = $('#tokentag').val()
submitdata = { "authenticity_token": tokentag, ...+whatever else you need to include+...}

then call the $.ajax with submitdata.