jruby - How can Rails have different csrf tokens at different times? -
tl;dr
in product, rails seems have different csrf tokens on different page visits, thought there 1 csrf token per session. misunderstanding how rails' csrf token works? or situation?
some contextual information: website war running within tomcat. part of code runs on rails via jruby-rack (please don't ask why ;) it's i've got).
details
for situation i'm in, manually added debugging code in rail's csrf code. changed verified_request? method this:
def verified_request? logger.info "printing info `verified_request?` ..." logger.info "\trequest_forgery_protection_token = #{request_forgery_protection_token}" logger.info "\tform_authenticity_token = #{form_authenticity_token}" logger.info "\tparams[request_forgery_protection_token] = #{params[request_forgery_protection_token]}" logger.info "\trequest.headers['x-csrf-token'] = #{request.headers['x-csrf-token']}" logger.info !protect_against_forgery? || request.get? || form_authenticity_token == params[request_forgery_protection_token] || form_authenticity_token == request.headers['x-csrf-token'] end below log output. important part 'form_authenticity_token' different @ different times (but repeat @ times). doesn't make sense me because form_authenticity_token function returns same thing every single session.
printing info `verified_request?` ... request_forgery_protection_token = authenticity_token form_authenticity_token = wmpfnom8s1z0tlfedjrpwkowygna/k21skgrolp2dmy= params[request_forgery_protection_token] = request.headers['x-csrf-token'] = printing info `verified_request?` ... request_forgery_protection_token = authenticity_token form_authenticity_token = vigs5kkogvte7sq+fprsowiwujjng8y2wptqqeshcy0= params[request_forgery_protection_token] = request.headers['x-csrf-token'] = printing info `verified_request?` ... request_forgery_protection_token = authenticity_token form_authenticity_token = lbpcrphpuyyiyfcs30jonz+vqosqg1vkbbpojl07dne= params[request_forgery_protection_token] = request.headers['x-csrf-token'] = vigs5kkogvte7sq+fprsowiwujjng8y2wptqqeshcy0= printing info `verified_request?` ... request_forgery_protection_token = authenticity_token form_authenticity_token = wmpfnom8s1z0tlfedjrpwkowygna/k21skgrolp2dmy= params[request_forgery_protection_token] = vigs5kkogvte7sq+fprsowiwujjng8y2wptqqeshcy0= request.headers['x-csrf-token'] =
it turns out running multiple processes of jruby and using memory caching. meant each process had different session. returned having 1 process of jruby.
Comments
Post a Comment