Form_tag gives authenticity InvalidAuthenticityToken

Question

I have a form_tag that is added to a modal by JS and occasionally it gives an InvalidAuthenticityToken error when submitted although other times it works fine (it may work multiple times in a row, other times it works once then gives an error in subsequent submissions, and others it doesn't work the first time but a page reload and it may or may not work again). I tried adding authenticity_token: false and protect_from_csrf: false but the same thing is still happening and I'm confused why this is the case.

<%= form_tag order_extras_url, method: "patch", remote: true, authenticity_token: false, protect_from_csrf: false, class: "mb0" do %>

...

<% end %>

Answer 1

You are able to skip the authenticity_token in the server side adding the following line in your controller:

skip_before_filter :verify_authenticity_token, only: :your_action

For Rails 4 use skip_before_action instead.