REST urls and Authenticity Token

Michael Rigart
Mon, 19 May 2008 10:27:06 -0000

Hi,

I have a few questions regarding REST and the Authenticity Token. I''m
using a RESTful aproach for my small project and everything worked fine
untill I wanted to  destroy a record.

Lets say we have a listing of folder (a folder is just a record) and I
want to destroy one by using this link:

<%= link_to image_tag(''icons/folder_delete.png''), {:url
=>
folder_path(folder.name) }, { :method => :delete, :title =>
''Delete this
folder'', :confirm => "All files and subfolders will be
deleted!\nAre you
sure?" } %>

How come the form generated for this link doesn''t contain a
Authenticity
token? For all my other crud forms I also had to explicitly write the
<%= token_tag %>. This may be the right way, but I remember reading
something on this forum that the Authenticity token is generated
automatically for destroy links and forms.

Another think that I would like to answer is the RESTful urls. In normal
crud actions you rely on the unique id of your record. My project is a
multi user system where a user can create folder, etc. To make the url
more clear for the user, I would like to use the name of a given folder
(record). That is why is use the following : folder_path(folder.name) .

But in my controller, I can''t use redirect_to folder_url(@folder), so I
use something like
redirect_to(folder_path(session[:current_folder].name)) instead.
My question is do I brake some "REST rule" by doing this? Or is there
a
better, more cleaner way for displaying the folder names and still be
using id''s?

Thank you in advance for your replies