Why I can't send a post method in RoR?

Question

I have this method to post the value to the "/store/add_to_cart"

<form action = "/store/add_to_cart" method="post">
<% for product in @products -%>
<div class   = "entry">
<%= product.title %>
<%= product.price %>
<p>
</div>
<% end %>
<%= select( "payment", "id", { "Visa" => "1", "Mastercard" => "2"}) %>
<%= submit_tag 'Make Order' %>
</form>

In the /store/add_to_cart.html.erb, I created :

<%= params.length %>
<% for i in params%>
<%=i%>
<br/>

<% end %>

But I get this error: ActionController::InvalidAuthenticityToken in StoreController#add_to_cart

What's happen? but after I change it to the get method, I can get all the params, wt's happen?

Answer 1

You are not using rails form_for helper to generate the <form> HTML markup, what this method does in addition is to add a hidden input field that is used to prevent CSRF attacks.

You have three options:

1. Use the form_for, form_tag... helper
2. Include the hidden input yourself
3. Disable the CSRF support