Question

I have the following model:

Project
 - name:text
 - description:text

And this is snippet of the form I’ve written in HAML for new project:

%p Create a new project:

%form{:method => "post", :action=>"/projects/"}
  %label{:for => "project-name[name]"} Name:
  %input{:type=>'text', :size=>40, :name=>'projectname', :id=>'project-name'} 
  %br/
  %label{:for => "project-description[description]"} Description:
  %textarea{:rows=>'10',:cols=>'10',:name=>'projectdescription',:id=>'project-description'}
  %br/
  %input{:type=>'submit', :value=>'Create'}

when the user clicks submit, the session data seems to be cleared.

Here is why I suspect this:

• I am using omniauth, when a user signs in, I set session[:user_id] = user.id
• I have a redirect in the project controller for ensuring the user is always signed in for all actions
• the index and new actions are handled properly.
• instead of the create action being handled, the user is bounced to the sign in page (as per the before_filter)
• I replicated the same functionality with erb files and there no issue. When I drop in the new.haml file the error shows up again.

Any ideas?

Answer 1

I believe that what’s happening here, is that you have `protect_from_forgery’ in your ApplicationController, but the csrf token is not sent to application. Check if you have a relevant rails.js included if it’s AJAX call. And if you were using form_for, then the helper would automatically insert the hidden field with the csrf token.