ruby-on-rails - 当我尝试创建用户时，rails 说 ActionController::InvalidAuthenticityToken

Question

---

已更新:
问题已解决
我只需要将 protect_from_forgery 放在 Users Controller 中。感谢大家。

---

rails 4.0.2
当我尝试在 users 表中创建新记录时，我在浏览器中收到此消息:

ActionController::InvalidAuthenticityToken in UsersController#create
ActionController::InvalidAuthenticityToken

但它发生在 Chrome(32.0.1700.107) 和 Opera(12.16) 浏览器中。在 Firefox(27.0.1) 和 IE 10.0.13 中一切正常。也许这并不重要，但我不得不说我也使用 has_secure_password(bcrypt_ruby)。

Rails 日志:

...
Started POST "/users" for 127.0.0.1 at 2014-02-19 10:26:05 +0400
Processing by UsersController#create as HTML
  Parameters: {"utf8"=>"✓", "authenticity_token"=>"93jpgxCSY3XzZkIJKraOodyObBoaPoPMVz3RiOVBL10=", "user"=>{"name"=>"", "surname"=>"", "patronymic"=>"", "email"=>"", "address"=>"", "phone"=>"", "phone2"=>"", "password"=>"[FILTERED]", "password_confirmation"=>"[FILTERED]"}, "commit"=>"Создать пользователя"}
Can't verify CSRF token authenticity
Completed 422 Unprocessable Entity in 2ms

ActionController::InvalidAuthenticityToken (ActionController::InvalidAuthenticityToken):
  actionpack (4.0.2) lib/action_controller/metal/request_forgery_protection.rb:163:in `handle_unverified_request'
  actionpack (4.0.2) lib/action_controller/metal/request_forgery_protection.rb:170:in `handle_unverified_request'
  actionpack (4.0.2) lib/action_controller/metal/request_forgery_protection.rb:177:in `verify_authenticity_token'
...

查看文件users/new.html.slim:

= stylesheet_link_tag 'users'
.new_user_container
  = form_for @user do |f|
    = f.label "Имя"
    br
    = f.text_field :name
    br
    = f.label "Фамилия"
    br
    = f.text_field :surname
    br
    = f.label "Отчество"
    br
    = f.text_field :patronymic
    br
    = f.label "Пароль"
    br
    = f.text_field :password
    br
    = f.label "Подтверждение пароля"
    br
    = f.text_field :password_confirmation
    br
    br
    = f.submit "Создать пользователя"

Answer 1

我只需要将 protect_from_forgery 放在用户 Controller 中。感谢大家。

class UsersController < ApplicationController
  protect_from_forgery

  def index
    #@users = User.all.includes(:roles)
    @users = User.all
  end
  def show

  end
  def new
    @user = User.new
  end
  def create
    @user = User.new user_params
    puts @user.errors.inspect
    if @user.save
      flash[:notice] = "Пользователь удачно создан"
      redirect_to :users
    else
      flash[:notice] = "Пользователь не создан"
      render file: :'users/user_error'
    end
    flash["notice"] = "Test notice"
    #redirect_to :users
  end
end