Rails and Rack::Protection::AuthenticityToken

rails 4.2.6
ruby 2.3

I'm having some difficulty to implement the rack-protection gem with rails.

The AuthenticityToken protection was enabled in this way:

#application.rb

module MyApp
    class Application < Rails::Application
        config.middleware.use Rack::Protection
        config.middleware.use Rack::Protection::AuthenticityToken
    end
end

The problem is that I aways get a "Forbidden" when logging with Devise gem.

WARN -- : attack prevented by Rack::Protection::AuthenticityToken

However the "csrf_meta_tags" are present on the top of every page:

<head>
    <meta name="csrf-param" content="authenticity_token">
    <meta name="csrf-token" content="+4lRTVfIWBjsgGXEzHFVCIf/Bi/jqqfkLPg6qdw5FMHA1L3Eh36I+hALcRIhv1VjfgTznssJqvRh+/IEMhyNeA==">
</head>

And the authenticity_token is passed as an input hidden inside the session form too:

<input name="authenticity_token" value="+4lRTVfIWBjsgGXEzHFVCIf/Bi/jqqfkLPg6qdw5FMHA1L3Eh36I+hALcRIhv1VjfgTznssJqvRh+/IEMhyNeA==" type="hidden">

What am I missing here?

I'm in development mode, not production.

Thanks!

Rails and Rack::Protection::AuthenticityToken

0 Answers