#6228 Added disable_authenticity_token option to form helper - Ruby on Rails

Type	To find
responsible:me	tickets assigned to you
tagged:"@high"	tickets tagged @high
milestone:next	tickets in the upcoming milestone
state:invalid	tickets with the state invalid
created:"last week"	tickets created last week
sort:number, importance, updated	tickets sorted by #, importance or updated
Combine keywords for powerful searching.
Use advanced searching »

This project is archived and is in readonly mode.

#6228 ✓resolved

Added disable_authenticity_token option to form helper

Reported by 2kan | December 27th, 2010 @ 04:09 PM | in 3.1

I've added disable_authenticity_token option to the form helper. So now we can generate forms without authenticity_token tag.
It is useful when we generate forms for some external resources like payments and billings where names of fields are often restricted so forms with authenticity_token are not valid.

Now we can write:

form_for(@survey, :disable_authenticity_token => true)

or:

form_tag('/', :disable_authenticity_token => true)

disable_authenticity_token-fix-against-rails-edge.diff 3.6 KB

Comments and changes to this ticket

You flagged this item as spam.
Yaroslav Markin December 29th, 2010 @ 04:36 PM
- Assigned user set to “José Valim”
This is basically really useful when you need to send data to a 3td party service (payment gateway, in my case) without any Rails tokens.
Santiago Pastorino February 3rd, 2011 @ 04:52 PM
- State changed from “new” to “open”
- Milestone set to “3.1”
- Assigned user changed from “José Valim” to “Santiago Pastorino”
- Importance changed from “” to “Low”
Looks good can you provide docs for that? would be nice to add API docs at least
Xavier Noria February 3rd, 2011 @ 10:04 PM
Would you please add some RDoc documenting this option and its rationale/real use case. Also please the guide that covers forms? All in a single (complete) patch.
You flagged this item as spam.
Lachlan Sylvester February 4th, 2011 @ 10:10 PM
Similar functionality has been added in https://rails.lighthouseapp.com/projects/8994/tickets/2988-authenti.... I am not sure that this is still needed.
Dan Pickett February 4th, 2011 @ 10:24 PM
Agreed with Lachlan - this appears to be duplicated functionality that has already been committed in #2988. This ticket should be closed.
Santiago Pastorino February 5th, 2011 @ 12:22 AM
yeah true, but ... seems that this was not done for form_for.
Can you guys confirm this? if it was not done for form_for can you provide a patch for it using the same approach?.
Thanks.
You flagged this item as spam.
2kan February 5th, 2011 @ 03:14 AM
Santiago, since form_for works through form_tag we need just to write something like:
```
form_for(@something, :html => { :authenticity_token => 'some_token_of_false' }) do |f|
```
So right now this ticket is duplicate to functionality committed in #2988.
Santiago Pastorino February 5th, 2011 @ 03:49 AM
2kan right, but we don't have tests and docs for form_for though.
You flagged this item as spam.
2kan February 5th, 2011 @ 03:41 PM
Added test for for_for and new authenticity_token option. Added docs. Added section about it to form helpers guide. All in one single patch.
- 6228-added-test-and-docs.diff 6.4 KB
Repository February 5th, 2011 @ 09:02 PM
- State changed from “open” to “committed”
(from [b9309b47cda12db34ac3427fbafff2dca0314ed7]) Added tests for form_for and an authenticity_token option. Added docs for for_for and authenticity_token option. Added section to form helpers guide about forms for external resources and new authenticity_token option for form_tag and form_for helpers.

[#6228 state:committed]

Signed-off-by: Santiago Pastorino santiago@wyeworks.com
https://github.com/rails/rails/commit/b9309b47cda12db34ac3427fbafff...
Dan Pickett February 6th, 2011 @ 04:27 PM
I dig the change, but I think putting the authenticity_token arg in the html option hash is unintuitive. I've attached a patch that puts the function in parity with the remote option.
- auth_token_remote_parity.diff 3.2 KB
Dan Pickett February 6th, 2011 @ 06:17 PM
- State changed from “committed” to “open”
[state:open]
Santiago Pastorino February 6th, 2011 @ 09:05 PM
Yeah agree pushing the change
Repository February 6th, 2011 @ 09:05 PM
- State changed from “open” to “committed”
(from [3026843dc1ff42a632ebe989e1f6dfadb0cd10a5]) put authenticity_token option in parity w/ remote

[#6228 state:committed]

Signed-off-by: Santiago Pastorino santiago@wyeworks.com
https://github.com/rails/rails/commit/3026843dc1ff42a632ebe989e1f6d...
You flagged this item as spam.
2kan February 7th, 2011 @ 11:39 AM
- State changed from “committed” to “open”
[state:open]

Updated form helpers guide for new place of authenticity_token option in for_for helper.
- 6228-updated-form-helpers-guide.diff 1.5 KB
Santiago Pastorino February 7th, 2011 @ 12:51 PM
- State changed from “open” to “resolved”
Pushed