Rails error guide
Need help fixing an InvalidAuthenticityToken error?
Uh-oh, you ran into an error! Don’t worry, AppSignal is here to help you. Besides monitoring for errors, we’ve written some guides on how to fix common errors. Let us know if you need any more help.
Why does this error occur?
This error occurs when Rails’ request forgery protection system does not accept a POST, PUT or DELETE request.
When Rails generates the HTML for a form or a XHR-powered link it adds a authenticity_token hidden field or parameter. Before letting the request through to the controller Rails checks that the parameter is present and correct.
The purpose of this protection mechanism is making it harder for bots do automated requests. They have to fetch the form as well and extract the authenticity_token from it.
There a number of things that can go wrong to cause this error:
Missing csrf_meta_tags
This Rails helper adds two meta tags that can be used from JavaScript to add the right parameters. This helper should be called in your layout file. If it’s missing, requests sent via JavaScript will result in this error on the server.
<head>
<%= csrf_meta_tags %>
</head>Missing jquery_ujs
If the unobtrusive scripting adapter for jQuery is not required in your assets the necessary parameters are not added. Make sure the jquery-rails gem is installed and that this is present in your main assets file. If it’s missing, requests sent via JavaScript will result in this error.
//= require jquery
//= require jquery_ujsPage caching
If you use page caching, Rails will keep the static HTML for a page in the cache. After a while the authenticity token for this page is stale and posting a form will result in this error. In this case either don’t use page caching, or disable the forgery protection for that controller action:
skip_before_action :verify_authenticity_tokenAPIs and webhooks
If you have controllers that are meant to be called by external parties you should disable forgery protection. This is relevant the case for APIs and web hooks:
skip_before_action :verify_authenticity_tokenPacked with features
Real-time alerts. Amazing insights.
Get real-time alerts for issues in your applications. Dive deep into your requests and data to debug issues to their core.
Error Tracking
Track exceptions, get error alerts, debug and fix bugs with ease.
Performance Monitoring
Monitor the performance of your slowest actions down to the nanosecond.
Host Monitoring
Monitoring for your servers: keep an eye on CPU, Disk, Network & more.
Anomaly Detection
Avoid surprises and set triggers for anomalies on any metric you'd like.
Uptime Monitoring
Get alerted in real-time when your application is down.
Metric Dashboards
Collect metrics from your code and chart them on interactive dashboards.
Log Management
Collect and manage logs in an easy-to-use interface.
Automated Dashboards
Visualize your application performance metrics.
Process Monitoring
Monitor your application's background jobs and processes.
Time Detective
Monitor your application's background jobs and processes.
MCP Server
Debug faster from your AI editor with direct access to AppSignal insights.
Make your next crash make sense.
Free for 30 days. No credit card. Two-minute install.