Filter chain halted as :verify_signed_out_user rendered or redirected error when making a delete fetch in Rails Devise

Viewed 1441

I am using react as my front end, and rails/devise as my backend/auth. Logging in and registering a new user work perfectly fine, however when I try to log out using the /users/sign_out route created by devise (as outlined by the wiki) I get the error:

Filter chain halted as :verify_signed_out_user rendered or redirected

My fetch call is as follows:

const logout = (event) => {
    event.preventDefault();
    fetch('http://localhost:3000/users/sign_out',{
        method: 'DELETE',
        headers: {
            'Content-type': 'application/json',
            'Accept': 'application/json'
        },
        body: JSON.stringify({ 
            user: JSON.parse(localStorage.getItem('user'))
        })
    })
    .then(res => res.json())
    .then(resp => console.log(resp))
}

I have made the following changes to my application controller as well. Not entirely sure if this may be part of the issue:

class ApplicationController < ActionController::API
    include ActionController::MimeResponds
    respond_to :json, :html

    before_action :configure_permitted_parameters, if: :devise_controller?
    before_action :authenticate_user!

    protected

    def configure_permitted_parameters
        devise_parameter_sanitizer.permit(:login, keys: [:username, :email, :password])
        devise_parameter_sanitizer.permit(:sign_up, keys: [:username, :email, :password])
        devise_parameter_sanitizer.permit(:account_update, keys: [:username])
    end

end

I have tried using

skip_before_action :verify_signed_out_user 

in my application controller but it raises an error that the method is undefined.

ArgumentError (Before process_action callback :verify_signed_out_user has not been defined):

Any and all help is appreciated. Thank you!

1 Answers

I think the problem is that you're not sending the user Authentication token header with your request. You're just sending user as a body args. Usually in logic we set Header like Authorization: Bearer xyz to authenticate the user.

When you want a user to sign out, you'll have to send Auth token so that devise can identify the user and sign the user out.

So when devise tries to run verify_signed_out_user -> since user is not signed in(no auth token in your case), this problem occurs.

And verify_signed_out_user is not a global method like authenticate_user!, so you can't call before_action :verify_signed_out_user like we usually call before_action :authenticate_user! to authenticate the user.

Related