Devise: InvalidAuthenticityToken

[interpegasus]

Environment

• Ruby [2.6.1]
• Rails [6.0.3.2]
• Devise [4.7.1]

Current behavior

ActionController::InvalidAuthenticityToken","exception_backtrace":["/home/ubuntu/.rvm/gems/ruby-2.6.1/gems/actionpack-6.0.3.2/lib/action_controller/metal/request_forgery_protection.rb:215:in `handle_unverified_request'","/home/ubuntu/.rvm/gems/ruby-2.6.1/gems/actionpack-6.0.3.2/lib/action_controller/metal/request_forgery_protection.rb:247:in `handle_unverified_request'","/home/ubuntu/.rvm/gems/ruby-2.6.1/gems/devise-4.7.1/lib/devise/controllers/helpers.rb:255:in `handle_unverified_request'","/home/ubuntu/.rvm/gems/ruby-2.6.1/gems/actionpack-6.0.3.2/lib/action_controller/metal/request_forgery_protection.rb:242:in

When trying to upgrade rails gem, it returns ActionController::InvalidAuthenticityToken
It works fine with :
rails (6.0.2.2)

Expected behavior

Devise and the latest version of rails should work fine.

[lylo]

Are you using Rack 2.2.3 by any chance? I have seen a similar issue which can be addressed by downgrading to Rack 2.2.2. I'm not (yet) sure why exactly.

[yboulkaid]

I'm seeing the same issue with Rack 2.2.3. The app in question is served in plain http (without TLS/HTTPS), so maybe that's related to https://github.com/rails/rails/issues/22965#issuecomment-336190639?

[jr180180]

Ran into a similar issue today after moving my project from my desktop to my laptop. Similar versions to what you've mentioned above. Except mine are:

Ruby [2.7.1]
Rails [6.0.3.2]
Devise [4.7.2]

I tried downgrading gems, reinstall ruby, hackish techniques I'm not proud of, anything I could think of...

Eventually ran into "ActionController::InvalidAuthenticityToken Error since re cloned git repo"

After running the following task, the problem was solved!

rails dev:cache

Didn't even think of looking into the tmp/caching-dev.txt file.

Hopefully, that'll help ya!

[lylo]

Eventually ran into "ActionController::InvalidAuthenticityToken Error since re cloned git repo"

After running the following task, the problem was solved!

rails dev:cache

Didn't even think of looking into the tmp/caching-dev.txt file.

This didn't work for me, nothing changed. rails dev:cache just toggles caching on or off – did you toggle it on and it started working?

I've also tried clearing the cache (rails tmp:cache:clear) etc and it makes no difference.

[lylo]

In my particular app, downgrading rack from 2.2.3 to 2.2.2 still solves the issue. I'm still trying to understand why...

[jr180180]

This didn't work for me, nothing changed. rails dev:cache just toggles caching on or off – did you toggle it on and it started working?

Shucks... Sorry it didn't help ya. Yeah, I toggled it on using that rake command and it just started working for me. I haven't had the chance to dig in to find out why caching must be on for my project. If someone sees this and knows, I'd love to know why. 🤔

[yboulkaid]

So, after looking into it more, this is probably not a Devise issue, but something related to the application's SSL config.

For my case, it was a bad configuration of the heroku SSL + the Cloudflare SSL that didn't play well together. I removed the cloudflare SSL handling and kept the heroku one, and it solved the issue.

[lylo]

So, after looking into it more, this is probably not a Devise issue, but something related to the application's SSL config.

Thanks for the update. This is interesting as I'm seeing this in development mode locally, which isn't running SSL. But I'm inclined to agree it's a Rails or Rack issue rather than with Devise.

[carlosantoniodasilva]

Thanks all for digging into this one some more. Given most of us seem to agree this is not a Devise specific issue, I'm going ahead and closing it here.

If anyone is able to confirm it's Devise related and can provide a reproduction script/test app, I'll be happy to do some investigation.

[michael-lins]

rails dev:cache did the trick for me and I've also tried just clearing the cache but with no results as well. My project was a pure clone from git on a local dev environment, plain macOS with Ruby 2.7.0 and Rails 6.1.0.alpha and was struggling with this for about 2 months now on my laptop, only the desktop was working.

Today I tried creating a new clone for the project on the same machine that is working (the desktop) and the error was simply there! So after trying rails dev:cache it worked like a charm.

I'll try to understand it and as soon as I get an ideia I'll drop an update here if there's none.

Cheers

Ran into a similar issue today after moving my project from my desktop to my laptop. Similar versions to what you've mentioned above. Except mine are:

Ruby [2.7.1]
Rails [6.0.3.2]
Devise [4.7.2]

I tried downgrading gems, reinstall ruby, hackish techniques I'm not proud of, anything I could think of...

Eventually ran into "ActionController::InvalidAuthenticityToken Error since re cloned git repo"

After running the following task, the problem was solved!

rails dev:cache

Didn't even think of looking into the tmp/caching-dev.txt file.

Hopefully, that'll help ya!

[mtomov]

I've started having this issue after adding config.session_store :cache_store in development.rb.

Check if you have that, and try commenting it out. I'm not sure how the two are related.

[Mejerigaarden]

Saw the exact same thing this morning - and lo' and behold -

rails dev:cache

certainly cleaned up my act 👍

I am very interested in any findings you guys come up with - I will post mine should I stumble upon the "missing link"

[fareesh]

Is there any clarity as to why rails dev:cache is affecting this?

[adnanpirota]

Is there any clarity as to why rails dev:cache is affecting this?

If you run into this while using Stimulus Reflex please bear in mind that if as instructed by Stimulus Reflex you set

config.cache_store = :redis_cache_store

and you set

config.session_store :cache_store

Redis server must be up otherwise you will get invalidAuthenticityToken error.

[interpegasus]

Just in case this solved it for my app. Using latest versions of devise, active admin and rails:
Gemfile
gem 'rack',"2.2.2"
Terminal
$ bundle update