Stupid Rails Mistakes: Caching and Authenticity Tokens
If you’re using anything other than fragment caching on pages with forms (and your fragment caching runs after your form blocks), then you’ll likely see Rails freakout on on the 2nd user that submits your cached form. The authenticity_token from the prior user has been cached and Rails is protecting you (I think). So, the moral is, don’t cache the auth_tokens (or find a clever way to workaround it).
Details and such on Rails 2.0 forgery protection.
Good presentation on Rails security
![[del.icio.us]](http://images.del.icio.us/static/img/delicious.small.gif){kind=small}
Thanks for this
I was facing a similar problem. The most frustrating part was, the code worked without any glitches on my localhost. But on the demo server it threw an InvalidAuthenticityToken error. Didn’t realize the form (using the authenticity token) was being cached because in development.rb caching was set to false. Turning that on, errors began appearing.
Anyway, don’t know if you will ever see this comment, it has been so long since you wrote this post. Had a good time feeding your fishes