Rails认证令牌和Ajax

Question

好吧，从我读过的其他网站和堆栈溢出中，Rails会抛出此认证令牌错误，因为我的表单不通过令牌 - 这是一项安全功能。这我明白。

但是我真的没有一种形式。我在这里有一个Ajax - 我的javascript将id'ed信息发布到处理函数中。

所以我的问题是，如何才能获得认证令牌，以我的控制器？

我的视图看起来像这样：

<% for transaction in @transactions %> 
     <% if transaction["category"] == '' %> 
     <% transaction["category"] = "Uncategorized" %> 
         <% end %> 

         <tr title = "<% if params[:type] %><%= params[:type] %><% else %>Purchases<% end %> <%= transaction["id"] %>" > 

          <td class="check"><a class="help" href="#"><img src="/images/icons/help.png" alt="?" /></a><input type="checkbox" /></td> 
          <td class="date"><% if transaction["date"] != "0000-00-00 00:00:00" %><%= transaction["date"].to_date.strftime("%B %d") %><% end %></td> 

          <% if params[:type] == "Bills" || params[:type] == "Reimbursements" %> 
          <td class="payee"><%= transaction["payee"] %></td> 
          <td class="details"><%= transaction["details"] %></td> 
          <% else %> 
          <td class="description"><% if transaction["detail"] == "undefined" %>n/a<% else %><%= transaction["detail"] %><% end %></td> 
          <td class="category">n/a</td> 
          <% end %> 

          <td class="amount">-$<%= transaction["amount"] %></td> 
         </tr> 

        <% end %> 

相应AJAX是如下：

/* send ids by ajax */ 
$('#tableActions li a').click(function() { 
    if(!$(this).hasClass('disabled')) { 
     action = $(this).text(); 
     ids = new Array(); 
     i = 0; 
     $('td.check input','#tableHolder').each(function() { if($(this).attr('checked')) { ids[i++] = $(this).parents('tr').attr('title'); } }); 
     $.ajax({ 
      type: "POST", 
      url: "/bulkaction", 
      data: "=" + action + "&ids=" + ids + "&authenticity_token=" + encodeURIComponent(AUTH_TOKEN), 
      success: function(data){ 
       $('#tableHolder').html(data); 
       /* bring back all functionality */ 
       initTable(); 
       /* set default sorting by date desc */ 
       $('th').removeClass('sortUp sortDown'); 
       $('th:eq(1)').addClass('sortDown'); 
       /* disable all actions */ 
       $('#tableActions li a').addClass('disabled'); 

      } 
     }); 
    } 
    return false; 
}); 

在控制器我的处理逻辑看起来像

def bulkaction 
      if request.post? 
       ids = params[:ids] 
       #Need to create a function here to parse out my string 
       puts ids #for testing purposes, just put my ids onto the console 
      end 

puts "This function was accessed and ran." 
end 

最后控制台说

Processing UserController#bulkaction (for ::ffff:xx.xxx.xxx.xxx at 2009-07-06 23                    :29:49) [POST] 
    Parameters: {"ids"=>"Purchases 10040963"} 

ActionController::InvalidAuthenticityToken (ActionController::InvalidAuthenticit                    yToken): 
    /usr/local/lib/ruby/1.8/webrick/httpserver.rb:104:in `service' 
    /usr/local/lib/ruby/1.8/webrick/httpserver.rb:65:in `run' 
    /usr/local/lib/ruby/1.8/webrick/server.rb:173:in `start_thread' 
    /usr/local/lib/ruby/1.8/webrick/server.rb:162:in `start' 
    /usr/local/lib/ruby/1.8/webrick/server.rb:162:in `start_thread' 
    /usr/local/lib/ruby/1.8/webrick/server.rb:95:in `start' 
    /usr/local/lib/ruby/1.8/webrick/server.rb:92:in `each' 
    /usr/local/lib/ruby/1.8/webrick/server.rb:92:in `start' 
    /usr/local/lib/ruby/1.8/webrick/server.rb:23:in `start' 
    /usr/local/lib/ruby/1.8/webrick/server.rb:82:in `start' 

如果有人能告诉我，我要去哪里错了这将是非常有益的。

Answer 1

解决了！改变了阿贾克斯

data: "=" + action + "&ids=" + ids + "&authenticity_token=" + AUTH_TOKEN, 

我加入到头部的每一页

<%= javascript_tag "const AUTH_TOKEN = #{form_authenticity_token.inspect};" if protect_against_forgery? %> 

Answer 2

这种技术效果很好，如果你正在使用jQuery。

http://henrik.nyh.se/2008/05/rails-authenticity-token-with-jquery

Answer 3

henrik.nyh.se似乎是向下的网站。其中的版本还包含一个错误，它将获取请求转变为使用Internet Explorer的发布请求。这个固定版本是从：http://www.justinball.com/2009/07/08/jquery-ajax-get-in-firefox-post-in-internet-explorer/

jQuery(document).ajaxSend(function(event, request, settings) { 
    if (typeof(AUTH_TOKEN) == "undefined") return; 
    if (settings.type == 'GET') return; // Don't add anything to a get request let IE turn it into a POST. 
    settings.data = settings.data || ""; 
    settings.data += (settings.data ? "&" : "") + "authenticity_token=" + encodeURIComponent(AUTH_TOKEN); 
});