My Rails 3.2 application has a controller called LaunchController that provides an api for other web applications so they can embed quizzes generated and scored in my application.
When an external application posts to the LaunchController, LaunchController#create authenticates using OAuth, caches an object @tool that knows about the external application, stores a cache key in the session session[:launch_tool_cache_key] and redirects to another controller AttemptsController#new that renders a quiz. When the user submits their answers, AttemptsControllert#create grades their quiz and uses @tool to posts a grade back to the external application.
Everything works fine in 3.2.
Last week I (finally!) upgraded my app to Rails 4.2. I sorted the rest of the migration and the application now works in development. Except for this process.
The problem lies in persisting the session[:launch_tool_cache_key] that contains the key I use to retrieve the serialized @tool from the cache so I can then send the grade back to the external application. My logs show that the cache key gets stored in the LaunchController, but after the redirect to AttemptsController#new the session key is gone.
Things I have tried:
- commenting out
protect_from_forgery - adding
skip_before_filter :verify_authenticity_token