Invalid AuthenticityToken everywhere

Question

I have a rails app that I just deployed which is generating Invalid AuthenticityToken errors anywhere a form is submitted. The app uses subdomains as account names and will also eventually allow for a custom domain to be entered. I have an entry in production.rb to allow for cross-domain session handling.

The problem is that you can't login / or submit any form because everything raises an Invalid AuthenticityToken error. The issue looks similar but not the same as http://stackoverflow.com/questions/1201901/rails-invalid-authenticity-token-after-deploy plus I'm not using mongrel. I've tried clearing cookies in the browser, and restarting passenger but no luck.

Anyone have any ideas?

The server is running nginx + passenger 2.3.11, and Rails 2.3.5.

#production.rb
config.action_controller.session[:domain] = '.domain.com'


#environment.rb
config.action_controller.session = {
   :session_key => '_app_session',
   :secret      => '.... nums and chars .....'
 }

Update: I just noticed that the session cookie is not getting set in my production environment. Thus I'm guessing the session can't be tied to the CSRF value. I'm wondering if the cookie not being set has to do with my dynamic subdomains?

Answer 1

TRY THIS

<%= javascript_tag "window._token = '#{form_authenticity_token}'" %>

OR REF:- http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html

Answer 2

Try adding the following to your ApplicationController:

protect_from_forgery :only => [:create, :delete, :update]

Solution from http://www.ruby-forum.com/topic/136093. Be aware that it may not be the most secure solution.

Answer 3

Make sure your server is configured to have the correct domain name. I've seen this when the cookie for the authenticity token was being set for a different domain than the server was actually on. Clients wouldn't realize they needed to send the cookie.

Another possibility is that your production session store is broken in some way. If Rails can't find a user's session it will fail with InvalidAuthenticityToken.