CODEWITHSUNDEEP
ruby-on-railsrubyforms
caiosa
caiosa

Reputation: 41

The action path of a form in Rails

The explanation below is big, but the question is really simple.

I'm doing a simple form project in https://www.theodinproject.com/paths/full-stack-ruby-on-rails/courses/ruby-on-rails/lessons/forms.

The first part where I am, I need to build a form manually - so that I can see how Rails does a lot for me when I use its helper methods. I'm stuck in this point:

Specify the method and the action attributes in your tag (use $ rails routes to see which HTTP method and path are being expected based on the resource you created).

The routes.rb file looks like this:

resources :users, only: [:create, :new]

I don't know how to determine which method should I use for the form - post or get. I don't know how to determine which action path I should use.

I've gone into the internet, Rails guides and etc, and have solved the other topics so far, but for this one I can't get through it.

My form so far:

<form action='/create' method="post" accept-charset="UTF-8"> 
<label for="username"></label>
<input type="text" id="username" name="username"><br>
<label for="email"></label>
<input type="text" id="email" name="email"><br>
<label for="password"></label>
<input type="text" id="password" name="password"><br>
<input type="submit" id="submit" value="Submit" >
</form>

Once I run it in the server and then submit the form - which I did - I should get:

"Submit your form and view the server output. Oops, we don’t have the right CSRF authenticity token (ActionController::InvalidAuthenticityToken) to protect against cross site scripting attacks and form hijacking. If you do not get an error, you used the wrong method from step 1."

Upvotes: 0

Views: 1184

Answers (2)

J.R. Bob Dobbs
J.R. Bob Dobbs

Reputation: 295

Hi there fellow Odin student!

It looks like you're doing this lesson. Me too!

It sounds like you're asking about what value to use with action attribute in the form.

When I created a form using the Rails formHelper methods, I inspected the HTML that Rails created when I was previewing the app/website (rails s). By opening up the Developer tools (F12 key, or right click the mouse and choose inspect)I was able to see that the form Rails created had an action equal to the name of the resource, with a forward slash in front of it.

So for your example, the resource created is "users". So the action attribute would be /users

to be complete, the solution would be something like: <form action="/users"...

Hope this helps!

Upvotes: 0

CR7
CR7

Reputation: 1206

Yes, Rails is smart) When u are sending the request to your server, Rails must know from where this request is coming. In short, if your form sending the CSRF token then Rails understand that u send this request, otherwise someone else on your behalf (CSRF attack).

To fix this bug u need to set <%= form_authenticity_token %> in your .erb view. It will generate this input that is below

<input type="hidden" name="authenticity_token" value="your_token_generate_by_rails">

Or for your testing purposes, u can use this in your controller which is processing your request. But never use it in future if you are don't know what are u doing)

skip_before_action :verify_authenticity_token

Upvotes: 1

Related Questions