错误:无法验证CSRF令牌真实性rails

我在Modal的Rails4中提交了一个表单.这个解决方案在Rails 3.x中运行良好

代码如下:

 

  

    

      

        ×
        
Copy Add-Ons From:
      
      

        

          <%= select_tag "from", options_from_collection_for_select(@shop.enabled_products - [@product], 'id', 'name'),  :class => "form-control %>
        
      
      

        Cancel
        Copy Add-ons
      
    
  

<% end %>

作为回复,它不是执行特定操作,而是通过登录我将其重定向到登录页面.

终端中的响应如下:

> Started POST "/products/10168/copy_addons" for 127.0.0.1 at 2016-01-10
> 21:19:10 +0100 Processing by ProductsController#copy_addons as HTML  
> Parameters: {"from"=>"10130", "id"=>"10168"} Can't verify CSRF token
> authenticity Redirected to http://myr-d.dev/login Filter chain
> halted as :require_login rendered or redirected

谢谢

在Rails 4中,有些约定可以阻止针对HTML请求的CSRF攻击.这篇SO帖子很好地解释了一般概念: 理解Rails真实性令牌

看起来您的Controller正在检查CSRF令牌,但您的表单没有发送一个.这是因为您

  <%= form_tag(copy_addons_product_path(@product), id: "addons-copy") do %>
    <%= select_tag "from", options_from_collection_for_select(@shop.enabled_products - [@product], 'id', 'name'),  :class => "form-control %>
  <% end -%>