WARNING: Can't verify CSRF token authenticity rails

问题:

I am sending data from view to controller with AJAXand I got this error:

WARNING: Can't verify CSRF token authenticity

I think I have to send this token with data.

Does anyone know how can I do this ?

Edit: My solution

I did this by putting the following code inside the AJAX post:

headers: {   'X-Transaction': 'POST Example',   'X-CSRF-Token': $('meta[name="csrf-token"]').attr('content') }, 

回答1:

You should do this:

1. Make sure that you have <%= csrf_meta_tag %> in your layout

2. Add beforeSend to all the ajax request to set the header like below:

---

$.ajax({ url: 'YOUR URL HERE',   type: 'POST',   beforeSend: function(xhr) {xhr.setRequestHeader('X-CSRF-Token', $('meta[name="csrf-token"]').attr('content'))},   data: 'someData=' + someData,   success: function(response) {     $('#someDiv').html(response);   } }); 

To send token in all requests you can use:

$.ajaxSetup({   headers: {     'X-CSRF-Token': $('meta[name="csrf-token"]').attr('content')   } }); 

回答2:

The best way to do this is actually just use <%= form_authenticity_token.to_s %> to print out the token directly in your rails code. You dont need to use javascript to search the dom for the csrf token as other posts mention. just add the headers option as below;

$.ajax({   type: 'post',   data: $(this).sortable('serialize'),   headers: {     'X-CSRF-Token': '<%= form_authenticity_token.to_s %>'   },   complete: function(request){},   url: "<%= sort_widget_images_path(@widget) %>" }) 

回答3:

If I remember correctly, you have to add the following code to your form, to get rid of this problem:

<%= token_tag(nil) %> 

Don't forget the parameter.

回答4:

Ugrading from an older app to rails 3.1, including the csrf meta tag is still not solving it. On the rubyonrails.org blog, they give some upgrade tips, and specifically this line of jquery which should go in the head section of your layout:

$(document).ajaxSend(function(e, xhr, options) {  var token = $("meta[name='csrf-token']").attr("content");   xhr.setRequestHeader("X-CSRF-Token", token); }); 

taken from this blog post: http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails.

In my case, the session was being reset upon each ajax request. Adding the above code solved that issue.

回答5:

Indeed simplest way. Don't bother with changing the headers.

Make sure you have:

<%= csrf_meta_tag %> in your layouts/application.html.erb 

Just do a hidden input field like so:

Or if you want a jQuery ajax post:

$.ajax({          type: 'POST',     url: "<%= someregistration_path %>",     data: { "firstname": "text_data_1", "last_name": "text_data2", "authenticity_token": "<%= form_authenticity_token %>" },                                                                                       error: function( xhr ){        alert("ERROR ON SUBMIT");     },     success: function( data ){        //data response can contain what we want here...       console.log("SUCCESS, data="+data);     } }); 

回答6:

1. Make sure that you have <%= csrf_meta_tag %> in your layout
2. Add a beforeSend to include the csrf-token in the ajax request to set the header. This is only required for post requests.

The code to read the csrf-token is available in the rails/jquery-ujs, so imho it i