Stupid Rails Mistakes: Caching and Authenticity Tokens
If you’re using anything other than fragment caching on pages with forms (and your fragment caching runs after your form blocks), then you’ll likely see Rails freakout on on the 2nd user that submits your cached form. The authenticity_token from the prior user has been cached and Rails is protecting you (I think). So, the moral is, don’t cache the auth_tokens (or find a clever way to workaround it).
Details and such on Rails 2.0 forgery protection.
Good presentation on Rails security
![[del.icio.us]](http://images.del.icio.us/static/img/delicious.small.gif){kind=small}
