Rails 4. How to add authenticity_token to forms rendered via partial?

Viewed 17853

On my rails app, on all pages, in the head section there are these 2 meta tags:

<meta name="csrf-param" content="authenticity_token" />
<meta name="csrf-token" content="027GUZBeEkmv..." />

On forms not rendered using a partial there is a hidden authenticity_token field

<input type="hidden" name="authenticity_token" value="D5TddQruJppDD3..." />

But this field misses if I simply load the form like this:

<%= render 'shared/comment_form' %>

Is this expected behavior ? Should I manually add an authenticity_token and if so how do I validate it ?

Edit:

shared/_comment_form.html.erb

<%= form_for([@post, @comment], :html => { :onsubmit => "validateCommentForm(event)" }, remote:true) do |f| %>
    <%= render 'shared/error_messages', object: f.object %>
    <div class="field">
        <%= f.text_area :content, placeholder: "Add to the article. Make it be more" %>
    </div>

    <%= f.submit "Save", class: "btn btn-info" %>
<% end %>

Also, adding <input type="hidden" name="authenticity_token" id="authenticity_token" value="ANYTHING" /> to that form still manages to post the info and create a new record...

2 Answers
Related