Nrthugu

I am working on migrating a big website package from Ruby 1.9 to Ruby 2.3, and I'm almost done. I've got Rails almost completely moved from 3.2 to 4.2, but I've run into one snag which I cannot figure out, and this project is my first experience with either Ruby or Rails, so I've been picking up the jargon as I go.

When I point my browser to my development server, all my GET requests succeed (200), but all my POST requests fail (500). After some research, I found out about Rails' built-in CSRF protection, and was able to determine that the package I'm working with had this protection in place when it was using Rails 3.2.

With Rails 4.2 in place, the protection seems to be preventing any POST requests from succeeding. After researching it further, I found that Rails 4 encrypts auth cookies before sending them to the web server, whereas Rails 3 did not, and that it's a good practice to use the Rails 3 cookie until all your users are up to Rails 4. I commented out the secret_key_base definition which I'd created as part of the migration and I cleared out my browser cache, so to my understanding, I should now be using the unencrypted Rails 3 cookie.

However, my POST requests still throw 500s. I can't share much code but I've referenced this official guide and I do have this line in my application controller:

protect_from_forgery with: :exception

I've also verified that if I comment out the protection and use:

skip_before_action :verify_authenticity_token

then the POST requests succeed (they are just very insecure).

Most of what I've read seems to indicate that this feature depends on the protect_from_forgery line I showed above, and that's it.

I cannot seem to get these requests to succeed and I wonder if it's just another layer of knowledge I haven't yet picked up. Would very much appreciate any help.

Your application layout, probably app/views/layouts/applications.html.erb needs to refer to <%= csrf_meta_tags %>

This is what is included and checked in all form posts.

If you are not using that layout in all your views, you need to figure out another way to make sure it gets referenced everywhere.

Docs

Do you have a config/secrets.yml file ? It should look something like this:

development:

  secret_key_base: a75d...



test:

  secret_key_base: 492f...



production:

  secret_key_base: <%= ENV["SECRET_KEY_BASE"] %>

And if so you need to make sure your server has the environment variable set. Keys need to be handled carefully and NEVER committed to a public repo i.e. GIT.

Refer to https://guides.rubyonrails.org/v4.2/security.html