InvalidAuthenticityToken

A controller always throw InvalidAuthencityToken, if it receives HTTP Post from a form which is not created from the controller itself.

It is the Rails protection mechanism.

Therefore, to solve it, we have to turn it off.

In the controller, just add this line:

protect_from_forgery :only => [:create, :update, :destroy]

It specifies that the protection mechanism only applies to those three actions (create, update, and destroy).

For other actions, they can receives a third-party HTTP Post without throwing InvalidAuthencityToken.