Ruby-on-rails ActionController::InvalidAuthenticityToken 禁用 JS/Ajax 请求时
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/19452853/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
ActionController::InvalidAuthenticityToken when disable JS/Ajax request
提问by medBouzid
I have two forms with option remote: true; one sends an Ajax request to createaction and the other one sends an Ajax request to destroyaction.
我有两种形式的选项remote: true；一个发送 Ajax 操作请求，create另一个发送 Ajax 操作请求destroy。
All work fines when JavaScript is enabled, but if I disable JavaScript, then I click, I get this error:
启用 JavaScript 时所有工作正常，但如果我禁用 JavaScript，然后单击，我会收到此错误：
ActionController::InvalidAuthenticityToken PersonsController#create
Why this error is shown, and how can I fix it ?
为什么会显示此错误，我该如何解决？
note: I'm using Rails 4
注意：我使用的是 Rails 4
Update
更新
When I use a normal form without option remote: true, rails automatically inserts a hidden field for an authentication token, but when I use remote: truein my form there is no such field in the HTML code. It seems like when there is remoteoption, then Rails handles the authentication token differently, so how I can get this to work in both cases?
当我使用没有 option 的普通表单时remote: true，rails 会自动为身份验证令牌插入一个隐藏字段，但是当我remote: true在表单中使用时，HTML 代码中没有这样的字段。似乎有remote选项时，Rails 会以不同的方式处理身份验证令牌，那么我如何才能在这两种情况下都能正常工作？
回答by Dan Garland
Bizarrely, this behaviour was changed in rails 4. http://www.alfajango.com/blog/rails-4-whats-new/
奇怪的是，这种行为在 Rails 4 中发生了变化。http://www.alfajango.com/blog/rails-4-whats-new/
Rails forms now will not render the CSRF field in the form unless you explicitly define it as an option to your form:
Rails 表单现在不会在表单中呈现 CSRF 字段，除非您明确将其定义为表单的选项：
<%= form_for @some_model, :remote => true, :authenticity_token => true do |f| %>
<% end %>
Adding this option allows you to gracefully degrade to a HTML fallback if Javascript is switched off.
添加此选项可让您在 Javascript 关闭时优雅地降级为 HTML 回退。
回答by Abhiram
Me too faced the same problem. I have used form_tag to create custom remote form, but i got the the following error,
我也面临同样的问题。我已经使用 form_tag 创建自定义远程表单，但出现以下错误，
ActionController::InvalidAuthenticityToken
I found that this is because in rail 4 wont add authenticity toke by default, so i added the following line in application.rb file,
我发现这是因为在 rail 4 中默认情况下不会添加真实性令牌，所以我在 application.rb 文件中添加了以下行，
config.action_view.embed_authenticity_token_in_remote_forms = true
which automatically verify the toke when submitting the remote forms. This solves the problem for me. Hope this will help some one.
在提交远程表单时自动验证令牌。这为我解决了问题。希望这会帮助某人。
回答by Cherniv
In my case i just had to add this line in my page:
就我而言，我只需要在我的页面中添加这一行：
<%= csrf_meta_tags %>
回答by Billy Chan
If there is no csrf field(a hidden field) inside the form, the submission can't be authenticated by Rails server.
如果表单中没有 csrf 字段（隐藏字段），则提交将无法通过 Rails 服务器进行身份验证。
If you make the form by form_tag, this situation will happen. The better approach is to use form_forfor a resource(new object or an existing object in db) and csrf field will be built by Rails automatically.
如果您通过 制作表格form_tag，就会发生这种情况。更好的方法是使用form_for资源（新对象或数据库中的现有对象）并且 csrf 字段将由 Rails 自动构建。
