By Zetal
[2018-08-01T00:08:14.616530 #13285] INFO – : Started POST “/login” for 108.3.168.115 at 2018-08-01 00:08:14 +0000 I, [2018-08-01T00:08:14.628178 #13285] INFO – : Processing by SessionController#create as HTML I, [2018-08-01T00:08:14.629969 #13285] INFO – : Parameters: {“utf8”=>“✓”, “authenticity_token”=>“9d2SwyolmTOHHo21SYVb7R8cGuTG8lCDpN5A/vrs1jr1IHv12yadJ+0YqH6gI4U5JQCZghF3vG0VQnhIdS7htQ==”, “session”=>{“email”=>“”, “password”=>“[FILTERED]”}, “commit”=>“Log in”} W, [2018-08-01T00:08:14.638901 #13285] WARN – : Can’t verify CSRF token authenticity. I, [2018-08-01T00:08:14.639597 #13285] INFO – : Completed 422 Unprocessable Entity in 9ms (ActiveRecord: 0.0ms) F, [2018-08-01T00:08:14.642361 #13285] FATAL – : F, [2018-08-01T00:08:14.642791 #13285] FATAL – : ActionController::InvalidAuthenticityToken (ActionController::InvalidAuthenticityToken):
This webpage works fine on my development box, which doesn’t use Nginx or Unicorn. At first I assumed that maybe I’d forgotten to populate the SECRET_KEY_BASE and that was causing issues, but it seems that the 1-click Rails App does in fact populate the ENV variable for SECRET_KEY_BASE, so I guess that isn’t the problem.
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
Accepted Answer
Referencing this link: https://www.rubytreesoftware.com/resources/secure-your-cookies/
I was able to solve the problem.
config/environments/production.rb
config.force_ssl = true
config/initializers/session_store.rb
set secure: true, optionally only do this for certain Rails environments (e.g., Staging / Production
Rails.application.config.session_store :cookie_store, key: ‘_testapp_session’, secure: true
I then had to also modify the nginx /rails config file, adding
proxy_set_header X-Forwarded-Proto https;
to each location next to the other proxy_set_header’s.
Become a contributor for community
Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.
DigitalOcean Documentation
Full documentation for every DigitalOcean product.
Resources for startups and SMBs
The Wave has everything you need to know about building a business, from raising funding to marketing your product.
The developer cloud
Scale up as you grow — whether you're running one virtual machine or ten thousand.
Get started for free
Sign up and get $200 in credit for your first 60 days with DigitalOcean.*
*This promotional offer applies to new accounts only.