ActionController InvalidAuthenticityToken Nosecret

rails2.0在environment.rb中打开
config.action_controller.session_store = :active_record_store
出现异常：
ActionController::InvalidAuthenticityToken in Store#index

Showing store/index.html.erb where line #8 raised:

No :secret given to the #protect_from_forgery call.  Set that or use a session store capable of generating its own keys (Cookie Session Store).

解决方法：
in your environement.rb you have :
config.action_controller.session = {
    :session_key => '_myapp_session',
    :secret      => 'secretpass'
  }
uncomment
  config.action_controller.session_store = :active_record_store
and add in your app/controller/application.rb
protect_from_forgery :secret => 'secretpass'
and all work well.

提示：
You should use the token_tag helper in your form to provide
the secret token needed by Rails for CSRF security reasons.

查询关键词：
ActionController InvalidAuthenticityToken
CSRF