Rails 4 CSRF not correct

Question

I'm on Rails

So I was messing around with my cookies and I might have deleted some important ones related to csrf. Now whenever I submit a form on my app I get: ActionController::InvalidAuthenticityToken

When I dig around in these requests it looks like this is why I am getting these errors.

When I actually debug through my request I get different values for form_authenticity_token and request.headers['X-CSRF-Token'] but I have no idea why.

it seems like request.headers['X-CSRF-Token'] is the one that actually matches the meta tag on my page (and hidden field tag in the form) and its form_authenticity_token that is incorrect.

Any thoughts?

@infused yep definitely did that. Tried it in several browsers too. — goddamnyouryan, Aug 27 '14 at 00:39
If you cleared your cookies and logged out of your app something else is messed up besides your cookies. — infused, Aug 27 '14 at 00:42
@infused i haven't changed anything else on my app since then, I've reverted my git changes, it's still happening. — goddamnyouryan, Aug 27 '14 at 00:47
Have you tried everything in http://stackoverflow.com/questions/3364492/actioncontrollerinvalidauthenticitytoken ? — infused, Aug 27 '14 at 00:55
@infused it works if I use `skip_before_action :verify_authenticity_token` however that seems to defeat the purpose. Additionally, This happens for my devise new sessions as well, which I can't skip if I want users to be able to sign in. Weirdly enough it works on production — goddamnyouryan, Aug 27 '14 at 01:04

score 1 · Accepted Answer · answered Aug 27 '14 at 05:13

1

So, weirdly enough, the reason I was seeing this was totally unrelated to anything else I thought I was seeing.

I had added this line to config/initializers/assets.rb

Rails.application.config.assets.prefix = ''

because on my production app I am using a cdn and its mapped to http://assets.mydomain.com and I didn't want it to resolve to http://assets.mydomain.com/assets/myasset.js

Unfortunately on production it looks like it was causing this issue, weirdly enough.

answered Aug 27 '14 at 05:13

goddamnyouryan

6,854
15
56
105

1

Oh my god, I could kiss you right now... You have no idea how many days of my life I've lost to this bug. I've delved deep into the rails and rack source code, (and learnt a hell of a lot), but I doubt I would have figured that one out on my own. – Jules Copeland Oct 04 '14 at 01:48

Rails 4 CSRF not correct

1 Answers1