Hi Wes, This page gives a bit more details about the protect_from_forgery method: http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html
It seems the method can be applied to any action in your controller (and is the default for Rails app >= 2.0). But it will only work for POST requests. It seems that AS doesn't include the authenticity token in the subform (at least in some cases). At least, that is my understanding of the problem. Hope this helps. Christian. On Feb 24, 3:59 pm, Wes Gamble <[email protected]> wrote: > Christian, > > I disabled all of my protect_from_forgery stuff to get around it for now > :). > > This does make me wonder if either: > > 1) protect_from_forgery doesn't apply to all POST requests, but only > certain actions implicitly (e.g. "create" "update" "delete" etc.) > 2) the edit_associated call is actually a GET and not a POST or > something weird like that (I'm not sure that really makes sense though). > > Wes > --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "ActiveScaffold : Ruby on Rails plugin" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/activescaffold?hl=en -~----------~----~----~----~------~----~------~--~---
