I'm experimenting with ActiveStorage, because I want to create a Rails app where the user can upload directly to DigitalOcean spaces.
However, I have already run into a CSRF problem.
I have declared digital ocean in my storage.yml:
do:
service: S3
access_key_id: this_is_a_secret
secret_access_key: this_is_also_a_secret
region: ams3
bucket: this_is_also_a_secret
endpoint: 'https://this_is_also_a_secret.ams3.digitaloceanspaces.com'
I have chosen that storage service in my development.rb
config.active_storage.service = :do
and I have added the aws gem to Gemfile
gem "aws-sdk-s3", require: false
I have required activestorage in my javascript bundle.
and I have added the following to my view for testing:
= form_for(VideoUpload.first, url: "/") do |form|
div = form.file_field :file, direct_upload: true
div = form.submit("Send that file")
When I submit the form, the activestorage.js library kicks in. It calls http://127.0.0.1:3000/rails/active_storage/direct_uploads which in turns throws a 422 due to a missing CSRF token. I have inspected the request and the controller is not wrong. There is no CSRF token set in the HTTP headers, X-CSRF-Token is oddly set to undefined.
The request body contains: {"blob":{"filename":"9T6qqsA-png-wallpapers.jpg","content_type":"image/jpeg","byte_size":122990,"checksum":"gqU9VBgS9mmH7s45qHIbug=="}}, so no CSRF token here either.
But the form in which the input file element is specified contains a token, so I would assume that activestorage.js would pick it up.
What am I missing here? The documentation at https://edgeguides.rubyonrails.org/active_storage_overview.html#direct-uploads doesn't imply that any special configuration in the JS side is necessary.
I am using Rails 5.2.1 and Ruby 2.5.1