rails-用于json/xml请求的InvalidAuthenticityToken [英] rails - InvalidAuthenticityToken for json/xml requests
问题描述
由于某种原因，当使用json或xml向我的应用程序发布请求时，我收到一个InvalidAuthenticityToken.我的理解是，Rails仅应为html或js请求要求真实性令牌，因此我不应该遇到此错误.到目前为止，我找到的唯一解决方案是禁用我想通过API访问的任何操作的protect_from_forgery，但是出于明显的原因，这不是理想的选择.有想法吗?
For some reason I'm getting an InvalidAuthenticityToken when making post requests to my application when using json or xml. My understanding is that rails should require an authenticity token only for html or js requests, and thus I shouldn't be encountering this error. The only solution I've found thus far is disabling protect_from_forgery for any action I'd like to access through the API, but this isn't ideal for obvious reasons. Thoughts?
def create
respond_to do |format|
format.html
format.json{
render :json => Object.create(:user => @current_user, :foo => params[:foo], :bar => params[:bar])
}
format.xml{
render :xml => Object.create(:user => @current_user, :foo => params[:foo], :bar => params[:bar])
}
end
end
这是我将请求传递给操作时在日志中得到的内容:
and this is what I get in the logs whenever I pass a request to the action:
Processing FooController#create to json (for 127.0.0.1 at 2009-08-07 11:52:33) [POST]
Parameters: {"foo"=>"1", "api_key"=>"44a895ca30e95a3206f961fcd56011d364dff78e", "bar"=>"202"}
ActionController::InvalidAuthenticityToken (ActionController::InvalidAuthenticityToken):
thin (1.2.2) lib/thin/connection.rb:76:in `pre_process'
thin (1.2.2) lib/thin/connection.rb:74:in `catch'
thin (1.2.2) lib/thin/connection.rb:74:in `pre_process'
thin (1.2.2) lib/thin/connection.rb:57:in `process'
thin (1.2.2) lib/thin/connection.rb:42:in `receive_data'
eventmachine (0.12.8) lib/eventmachine.rb:242:in `run_machine'
eventmachine (0.12.8) lib/eventmachine.rb:242:in `run'
thin (1.2.2) lib/thin/backends/base.rb:57:in `start'
thin (1.2.2) lib/thin/server.rb:156:in `start'
thin (1.2.2) lib/thin/controllers/controller.rb:80:in `start'
thin (1.2.2) lib/thin/runner.rb:174:in `send'
thin (1.2.2) lib/thin/runner.rb:174:in `run_command'
thin (1.2.2) lib/thin/runner.rb:140:in `run!'
thin (1.2.2) bin/thin:6
/opt/local/bin/thin:19:in `load'
/opt/local/bin/thin:19
推荐答案
在启用protect_from_forgery的情况下，Rails需要任何非GET请求的真实性令牌. Rails会自动在使用表单帮助器创建的表单或使用AJAX帮助器创建的链接中包括真实性令牌-因此，在正常情况下，您无需考虑它.
With protect_from_forgery enabled, Rails requires an authenticity token for any non-GET requests. Rails will automatically include the authenticity token in forms created with the form helpers or links created with the AJAX helpers--so in normal cases, you won't have to think about it.
如果您没有使用内置的Rails表单或AJAX帮助器(也许您正在使用不引人注目的JS或使用JS MVC框架)，则必须在客户端自行设置令牌并将其发送提交POST请求时连同您的数据一起使用.您可以在布局的<head>中放置以下行:
If you're not using the built-in Rails form or AJAX helpers (maybe you're doing unobstrusive JS or using a JS MVC framework), you'll have to set the token yourself on the client side and send it along with your data when submitting a POST request. You'd put a line like this in the <head> of your layout:
<%= javascript_tag "window._token = '#{form_authenticity_token}'" %>
然后，您的AJAX函数会将令牌与其他数据一起发布(例如jQuery):
Then your AJAX function would post the token with your other data (example with jQuery):
$.post(url, {
id: theId,
authenticity_token: window._token
});
这篇关于rails-用于json/xml请求的InvalidAuthenticityToken的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
