Rails: ActionController::InvalidAuthenticityToken

Question

I'm currently working on a project involving users, likes, and posts. I have a like/unlike button that I finally got to work some of the time, but on certain user's profiles when I go to unlike a post, I get thrown this error, which says that it is coming from my destroy action in my likes controller:

ActionController::InvalidAuthenticityToken

I'm using devise, but don't know if that has to do with the cause of the issue.

Right now this is what I'm working with:

<h4>All of <%= @user.email %>'s posts:</h4>
<% @user.posts.order('created_at DESC').each do |post| %>
    <li><%= post.content %></li>
<% unless current_user.likes.pluck(:post_id).include?(post.id) %>
<%= form_tag likes_path do %>
  <%= hidden_field_tag 'post_id', post.id %>
  <%= submit_tag "Like", :class => "like_button" %>
<% end %>
<% else %>
<% like = post.likes.where(user_id: current_user.id).first %>
<div class="unlike_button">
    <%= form_tag like_path(like) do %>
  <%= hidden_field_tag 'post_id', post.id %>

  <%= button_to "Unlike", like_path(post), method: :delete %>
</div>
<% end %>

---

class LikesController < ApplicationController
def create
@post = Post.find(params[:post_id])

@like = Like.new(user_id: current_user.id, post_id: @post.id)
if @like.save
    flash[:success] = "Post Liked!"
    redirect_back(fallback_location: root_path)
else
    flash[:notice] = "Couldn't like post"
    redirect_back(fallback_location: root_path)
end
end


def destroy
  @like = Like.find(params[:id])
  @like.destroy
  flash[:success] = "Post unliked"
  redirect_back(fallback_location: root_path)
end

end

     class PostsController < ApplicationController

def index
    @posts = Post.all
    @user = User.find(params[:user_id])
end

def new
    @post = Post.new
    @user = User.find(params[:user_id])
end

def create
    @post = current_user.posts.build(post_params)
    if @post.save
        flash[:success] = "Posted!"
        redirect_to user_path(current_user)
    else
        flash[:notice] = "Post could not be submitted"
        redirect_to users_path
    end
end

private

def post_params
    params.require(:post).permit(:content)
end
end 

Answer 1

There is a comment in application_controller.rb ..

  # Prevent CSRF attacks by raising an exception.
  # For APIs, you may want to use :null_session instead.

so ,you may try changing..

protect_from_forgery with: :exception

to this

protect_from_forgery with: :null_session

Hope it helps :)

Answer 2

I think I have figured it out.. At least have gotten it to work. I wasusing a form_for helper as well as button_to helper. I deleted the form_for helper and just stuck with

<%= button_to "Unlike", like_path(like), method: :delete %>

and it is now working

Answer 3

What helps me solve this problem is adding the Forward Slash in the URL

From:

= bootstrap_form_tag url: 'signup_with_phone' do |form|

To:

= bootstrap_form_tag url: '/signup_with_phone' do |form|