This project is archived and is in readonly mode.
Delete method in link_to causes InvalidAuthenticityToken error
-
nathanieljust posting in here to note that I came across the same issue and also the same fix (using button_to instead of link_to).
I'm currently running Rails3.0.0rc Ruby 1.9.2dev osx 10.6 -
Rohit Arondekar- Importance changed from to Low
Creating a scaffold in RC which has a link_to using the :method => delete option works fine. The code is —
<%= link_to 'Destroy', post, :confirm => 'Are you sure?', :method => :delete %>The corresponding HTML generated is —
<a rel="nofollow" data-method="delete" data-confirm="Are you sure?" href="/posts/2">Destroy</a>Anything else that needs to be done to reproduce this issue? Can you try it on a fresh app created using RC?
-
Andrius Chamentauskas
I can also confirm this bug. Futhermore it seems that if you put:
<%= link_to 'Destroy', post, :confirm => 'Are you sure?', :method => :delete %>
It generate additional hidden form, but if you use post_path(post) instead it does not generate it.
The generated HTML seems to be correct, I think it's more a bug with javascript that handles these kind of links.
This needs much higher priority...
-
plasko
This just happened on a new project that I started in the RC. I had to change it to button_to, though that's probably a little better anyway, since it doesn't rely on javascript to work.
-
Andrew White- State changed from new to invalid
I came across this the other day - you need to add <%= csrf_meta_tag %> to your layout file. The reason button_to works is that it creates an inline form which includes the hidden input auth token. The csrf_meta_tag helper adds a meta tag to the header which the rails.js code reads when it submits the form.
-
Rob Eastham
If <%= csrf_meta_tag %> alone does not seem to be helping then perhaps you have a conflict with jQuery. That's what it turned out to be for me. I wrote a bit more detail along with code required for a the solution on another related StackOverflow