ActionController::InvalidAuthenticityToken on delete form Rails 4 - ruby-on-rails

Question

I have a problem with Rails 4 and deleting multiple items in a database.
I am working on creating an email inbox and I would like to move an item into the "trash folder" and after that I want to redirect the user to the trash page, where he can delete the item from the database.
My code:
routes.rb
namespace :admin do
resources :inboxes do
collection do
match 'destroy_multiple' => 'inboxes#destroy_multiple', via: ['post','delete']
get 'sent'
get 'trash'
end
end
end
controller :
def destroy_multiple
if params[:action] == 'trash'
#del = Inbox.where(:id => params[:delete]).destroy_all
else
#del = Inbox.where(:id => params[:delete]).update_all(:folder =>'trash')
end
redirect_to admin_inboxes_path
end
And finally, my form (slim) :
= form_tag destroy_multiple_admin_inboxes_path, method: :delete, class: "multiple_delete" do
input type="hidden" name="action" value = controller.action_name
- #inboxes.each do |msg|
- #username = msg.email.gsub(/([^.]+)#.+/, '\1').gsub(/[^0-9A-Za-z]/, ' ').split.map(&:capitalize).join(' ')
tr class=(msg.read == 1 ? nil : 'unread')
td.inbox-small-cells
label.checkbox-custom.check-success
= check_box_tag "delete[]", msg.id, false, class: "for_del", id: "delete_#{msg.id}"
label for="delete_#{msg.id}"
td.inbox-small-cells
i.fa.fa-star.inbox-started
td
a.avatar href="/fr/admin/inboxes/#{msg.id}"
span.bg-primary =#username[0]
td.view-message.dont-show = #username
td.view-message = msg.subject
td.view-message.inbox-small-cells
td.view-message.text-right = msg.created_at.strftime("%d/%m")
I can with this code successfully move mail to the "trash", but I cannot delete them from the database.
Thank you!

Answer 1

You need to add the authenticity_token to your form. Try:
form_tag destroy_multiple_admin_inboxes_path, method: :delete, class: "multiple_delete", authenticity_token: true do
If you're working with a specific active record object, use form_for instead of form_tag, and the csrf field will automatically be built into the form by rails. However, this is a good time to be using form_tag.
The alternative solution is to change the config config.action_view.embed_authenticity_token_in_remote_forms to false, but this will make your site less secure, and it's better to just add authenticity_token: true to your form_tag.
Here is the documentation on form_tag