Do not include the authenticity token in forms where remote: true as ajax forms use the meta-tag value

1 files changed, 9 insertions, 2 deletions

diff --git a/actionpack/lib/action_view/helpers/form_tag_helper.rb b/actionpack/lib/action_view/helpers/form_tag_helper.rb
index e3ad96ec1b..74b6034c8d 100644
--- a/actionpack/lib/action_view/helpers/form_tag_helper.rb
+++ b/actionpack/lib/action_view/helpers/form_tag_helper.rb
@@ -609,8 +609,15 @@ module ActionView
             # responsibility of the caller to escape all the values.
             html_options["action"]  = url_for(url_for_options)
             html_options["accept-charset"] = "UTF-8"
-            html_options["data-remote"] = true if html_options.delete("remote")
-            html_options["authenticity_token"] = html_options.delete("authenticity_token") if html_options.has_key?("authenticity_token")
+            
+            if html_options.delete("remote")
+              html_options["data-remote"] = true 
+
+              # The authenticity token is taken from the meta tag in this case
+              html_options["authenticity_token"] = false
+            else
+              html_options["authenticity_token"] = html_options.delete("authenticity_token") if html_options.has_key?("authenticity_token")
+            end
           end
         end