Rail 4 Devise nil current_user for POST, PUT, DELETE JSON requests -
Below is the code for ApplicationController and OrdersController
POST request to create a new order, in me login_required Current_user gets zero and the filter chain is paused.
********** Request format: [application / jsn] - current_user: [] - user_sanell_in: [wrong] 14:30:26 web 1. The filter chain has been blocked: login_required sung or redirected 14:30:26 web. | Unofficial in full 401 19ms (Views: 0.3ms)
Database authentication using the database. Ruby: 2.1.1
ApplicationController:
Class ApplicationController & lt; ActionController :: Base # Prevent CSRF attacks by raising an exception. For #API, you might want to use it: null_session Instead, with Protect_from_forgery #: null_session before_filter: configure_permitted_parameters, if: devise_controller? Def logger.info login_required ("********** request format: [# {request.format}] - current_user: [# {current_user}] - user_signed_in: [{? User_signed_in} #]") if Request.format ==: html authenticate_user! The end of the refund until the current_use_mount is not allowed = incorrect response_to do | Format | Format.json {Render: Jason = & gt; Is_validated,: Status = & gt; : Unauthorized} format.protobuf {render: text = & gt; ProtoHelper.to_session_proto (is_validated) ,: Status = & gt; : Unauthorized} End End And Class Order Controller & lt; ApplicationController before_filter: login_required # post /orders.json # post-def end end making /orders.protobuf
This problem was detected that the user was signed with session [_csrf_token]
after signing. It has called protection_from_forgery
to throw a warning message to the rail: "CSRF can not be verified to Token" fails to find the user in the log and session.
, this policy is correct by default devise
config.clean_up_csrf_token_on_authentication = false Config variable set>
Comments
Post a Comment