Versions that I am using:
Ember-Cli-Rails -- 0.7.0
Ember-Cli -- 1.13.14
Rails -- 4.2.5
Ruby -- 2.3.0
After attempting many solutions including:
require jquery_ujs
on Rails manifesto.Rails.application.config.session_store :disabled
.- http://ift.tt/1wm5k1w.
- Changing Ember.js Adapter to append CSRF.
The end result is still pretty much the same:
Can't verify CSRF token authenticity
This is an example POST transaction with the intent to add a new post:
X-CSRF-Token:QgubDyYgf7j3yFKKRXOFYIhgYXUxHcDmXE3yUvGm+tBs72Z2S/rsgJejDwoS3AO1X2Z/W2Hq2bRwY2rtNKYAYA==
X-Requested-With:XMLHttpRequest
...
Authorization:Token token="xdggws5kcgK3QQQDdyHe", email="user@example.com"
From my understanding, the csrf token seems to be right as on the webpage head elements the csrf token does match the POST request:
<meta name="csrf-param" content="authenticity_token">
<meta name="csrf-token" content="QgubDyYgf7j3yFKKRXOFYIhgYXUxHcDmXE3yUvGm+tBs72Z2S/rsgJejDwoS3AO1X2Z/W2Hq2bRwY2rtNKYAYA==">
If I have protect_from_forgery with: :null_session
on my application_controller, then all transactions works including login through the Devise authentication token even though "Can't verify CSRF token authenticity still shows up on the logs. However, all communication is suddenly not accepted if I have protect_from_forgery with: :exception
which gives the sign that something terrible is happening...
Let me know if more information is necessary. Also, the source code is available on my Github http://ift.tt/1hxyoja
Aucun commentaire:
Enregistrer un commentaire