I have recently upgraded from Rails 6 to 7 and even though I have urlsafe_csrf_tokens set to true:
config/initializers/new_framework_defaults_6_1.rb
Rails.application.config.action_controller.urlsafe_csrf_tokens = true
when I start the application I keep getting the following warning:
DEPRECATION WARNING: URL-safe CSRF tokens are now the default. Use 6.1 defaults or above.
I would like to understand why?
In application.rb update your config.load_defaults with the current rails version as follows:
config.load_defaults 7.0
Short answer:
Yes, you have to increment your config.load_defaults at least for 6.1 (but preferably 7.0 since you are on Rails 7 already).
Long answer:
As far as I can tell from reading Rails repo, you are getting this message because starting with Rails 7.0 developers are not supposed to set urlsafe_csrf_tokens config option at all. It is supposed to be enabled by default by Rails. This is basically a preparation for Rails 7.1 in which this option will be removed.
The only solution is to upgrade your config.load_defaults from 5.2 to 6.1 at least (although I'd recommend 7.0 since you are on Rails 7 already). Actually I think I can even add that until you have config.load_defaults 7.0 in your app you can't say you have fully upgraded to Rails 7 since removing all new_framework_defaults_X_Y.rb files and incrementing config.load_defaults is a part of the upgrade flow as described here:
To allow you to upgrade to new defaults one by one, the update task has created a file config/initializers/new_framework_defaults_X.Y.rb (with the desired Rails version in the filename). You should enable the new configuration defaults by uncommenting them in the file; this can be done gradually over several deployments. Once your application is ready to run with new defaults, you can remove this file and flip the config.load_defaults value.