Is Rails 3 protect_from_forgery not working correctly?

Question

I am using Rails 3.0.2, which by default has protect_from_forgeryin application_controller.rb.

I wanted to call InvalidAuthenticityToken.
For this, I added this javascript to my page:

$('input[name=authenticity_token]').val('aaa')

Checking the DOM with Firebug I can see that the hidden field authenticity_tokenis updated correctly.

If I submit the form and check the log from the server, I see that the relative parameter is correctly set to 'aaa'. I would expect to receive InvalidAuthenticityTokenwhile the request is being processed, as it was right!

How is this possible?

Answer 1

/csrf . InvalidAuthenticityToken , reset. - ( -), handle_unverified_request .

Answer 2

, reset , html, ( , <% = csrf_meta_tag%). Rails , - ( javascript ) html Rails, , InvalidAuthenticityToken ' t ....