samedi 16 janvier 2016

CSRF token authenticity issues with ember-cli-rails

Versions that I am using:

Ember-Cli-Rails -- 0.7.0
Ember-Cli       -- 1.13.14
Rails           -- 4.2.5
Ruby            -- 2.3.0

After attempting many solutions including:

  1. require jquery_ujs on Rails manifesto.
  2. Rails.application.config.session_store :disabled.
  3. http://ift.tt/1wm5k1w.
  4. Changing Ember.js Adapter to append CSRF.

The end result is still pretty much the same:

Can't verify CSRF token authenticity

This is an example POST transaction with the intent to add a new post:

X-CSRF-Token:QgubDyYgf7j3yFKKRXOFYIhgYXUxHcDmXE3yUvGm+tBs72Z2S/rsgJejDwoS3AO1X2Z/W2Hq2bRwY2rtNKYAYA==
X-Requested-With:XMLHttpRequest
...
Authorization:Token token="xdggws5kcgK3QQQDdyHe", email="user@example.com"

From my understanding, the csrf token seems to be right as on the webpage head elements the csrf token does match the POST request:

<meta name="csrf-param" content="authenticity_token">
<meta name="csrf-token" content="QgubDyYgf7j3yFKKRXOFYIhgYXUxHcDmXE3yUvGm+tBs72Z2S/rsgJejDwoS3AO1X2Z/W2Hq2bRwY2rtNKYAYA==">

If I have protect_from_forgery with: :null_session on my application_controller, then all transactions works including login through the Devise authentication token even though "Can't verify CSRF token authenticity still shows up on the logs. However, all communication is suddenly not accepted if I have protect_from_forgery with: :exception which gives the sign that something terrible is happening...

Let me know if more information is necessary. Also, the source code is available on my Github http://ift.tt/1hxyoja




Aucun commentaire:

Enregistrer un commentaire