Download and rails 3 authentication tokens

Question

I'm trying to get a progress bar on file upload in rails 3 application using uploadify ( http://www.uploadify.com ) m stuck in authenticity tokens. My current uploadify configuration looks like

<script type="text/javascript" charset="utf-8"> $(document).ready(function() { $("#zip_input").uploadify({ 'uploader': '/flash/uploadify.swf', 'script': $("#upload").attr('action'), 'scriptData': { 'format': 'json', 'authenticity_token': encodeURIComponent('<%= form_authenticity_token if protect_against_forgery? %>') }, 'fileDataName': "world[zip]", //'scriptAccess': 'always', // Incomment this, if for some reason it doesn't work 'auto': true, 'fileDesc': 'Zip files only', 'fileExt': '*.zip', 'width': 120, 'height': 24, 'cancelImg': '/images/cancel.png', 'onComplete': function(event, data) { $.getScript(location.href) }, // We assume that we can refresh the list by doing a js get on the current page 'displayData': 'speed' }); }); </script> 

But I get this answer from the rails:

 Started POST "/worlds" for 127.0.0.1 at 2010-04-22 12:39:44 ActionController::InvalidAuthenticityToken (ActionController::InvalidAuthenticityToken): Rendered /opt/local/lib/ruby/gems/1.8/gems/actionpack-3.0.0.beta3/lib/action_dispatch/middleware/templates/rescues/_trace.erb (1.0ms) Rendered /opt/local/lib/ruby/gems/1.8/gems/actionpack-3.0.0.beta3/lib/action_dispatch/middleware/templates/rescues/_request_and_response.erb (6.6ms) Rendered /opt/local/lib/ruby/gems/1.8/gems/actionpack-3.0.0.beta3/lib/action_dispatch/middleware/templates/rescues/diagnostics.erb within rescues/layout (12.2ms) 

This seems to be because I am not sending an authentication cookie along with the request. Does anyone know how I can get the values ​​I should send there, and how can I get the rails to read it from HTTP POST, rather than trying to find it as a cookie?

Answer 1

Skipping authentication authentication is not ideal, as it opens up XSS attack vectors. Another way to make this work is described here: http://metautonomo.us/2010/07/09/uploadify-and-rails-3/

Please note that you may need to double the URL. The example uses rails u ', as well as encodeURLComponent (). However, if you have a more stylish / rails 3 type that is configured and creates a session data token / authenticity from the meta tags in the page header, you will need to call encodeURLComponent () twice.

Answer 2

This seems to be a mistake with rails 3.

https://rails.lighthouseapp.com/projects/8994-ruby-on-rails/tickets/3913

This meant that I had to change how I skipped the authentication token check:

Edited from

 protect_from_forgery :except => :upload 

For

 skip_before_filter :verify_authenticity_token, :only => :upload 

It seems to still work well

Answer 3

Well, I thought how to get around this. Is there a form in the view where you want to upload files. If you just use jquery to get the value of the hidden authentication token and pass it to the varData script.

 var token = ($('input[name=authenticity_token]').val()); scriptData : {'authenticity_token':token} 

Hope this works for you.