# Problem after updating to 0.4.0

**URL:** <https://discourse.hanakai.org/t/problem-after-updating-to-0-4-0/99>\
**Category:** issues\
**Created:** [July 2, 2015, 12:17pm UTC](https://discourse.hanakai.org/t/problem-after-updating-to-0-4-0/99 "2015-07-02T12:17:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![darwinrc](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.hanakai.org/darwinrc/32/73_2.png) [@darwinrc](https://discourse.hanakai.org/u/darwinrc)\
**Post date:** [July 2, 2015, 12:17pm UTC](https://discourse.hanakai.org/t/problem-after-updating-to-0-4-0/99/1 "2015-07-02T12:17:13Z")

</div>

Good day,

After updating lotusrb to 0.4.0 I’m getting this error after login in my web app:

```auto
Lotus::Action::InvalidCSRFTokenError: Lotus::Action::InvalidCSRFTokenError

```

My application.rb is like this:

```auto
sessions :cookie, key: "myapp.web", secret: ENV['WEB_SESSIONS_SECRET']`} 

```

Is there any extra change needed to be made to the sessions secrets after the update?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![darwinrc](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.hanakai.org/darwinrc/32/73_2.png) [@darwinrc](https://discourse.hanakai.org/u/darwinrc)\
**Post date:** [July 4, 2015, 3:07pm UTC](https://discourse.hanakai.org/t/problem-after-updating-to-0-4-0/99/2 "2015-07-04T15:07:51Z")

</div>

@pastuxo found the problem.

We included the hidden csrf\_token field in our forms:

```auto
%input{:name => "_csrf_token", :type => "hidden", :value => csrf_token}

```

That inclusion is not needed if form helpers are used.

---

<div class="post-metadata">

**Author:** ![AlfonsoUceda](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.hanakai.org/alfonsouceda/32/17_2.png) [@AlfonsoUceda](https://discourse.hanakai.org/u/AlfonsoUceda)\
**Post date:** [July 7, 2015, 7:23am UTC](https://discourse.hanakai.org/t/problem-after-updating-to-0-4-0/99/3 "2015-07-07T07:23:35Z")

</div>

Lotus 0.4.0 enables by default CSRF protection, I recommend to use form helpers instead use this workaround but it’s valid.

I talked with @darwinrc in the chat. Closing this issue.

---

<div class="post-metadata">

**Author:** ![AlfonsoUceda](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.hanakai.org/alfonsouceda/32/17_2.png) [@AlfonsoUceda](https://discourse.hanakai.org/u/AlfonsoUceda)\
**Post date:** [July 7, 2015, 7:23am UTC](https://discourse.hanakai.org/t/problem-after-updating-to-0-4-0/99/4 "2015-07-07T07:23:39Z")

</div>



---

<div class="post-metadata">

**Author:** ![jodosha](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.hanakai.org/jodosha/32/710_2.png) [@jodosha](https://discourse.hanakai.org/u/jodosha)\
**Post date:** [July 7, 2015, 8:47am UTC](https://discourse.hanakai.org/t/problem-after-updating-to-0-4-0/99/5 "2015-07-07T08:47:12Z")

</div>

@darwinrc I also remember you that you can bypass the CSRF protection by overriding `#verify_csrf_token?` in the related action:

```
module Web::Controllers::Books
  class Create
    include Web::Action

    def call(params)
      # ...
    end

    private

    def verify_csrf_token?
      false
    end
  end
end

```

Ref: [https://github.com/lotus/lotus/pull/248](https://github.com/lotus/lotus/pull/248)