ActionController::InvalidAuthenticityToken in Devise::SessionsController#create

[tavyy]

Environment

• Ruby 3.2.2
• Rails 7.0.5
• Devise 4.9.2

Current behavior

Extremely frustrating. All of a sudden I try to login/register I get Can't verify CSRF token authenticity..

I didn't do any changes and it was all working fine 1h ago.

Stack trace:

....
        def handle_unverified_request
          raise ActionController::InvalidAuthenticityToken, warning_message
        end
      end
    end
...

PS: Yes I have the CSRF and CSP tags:

<%= csrf_meta_tags %>
<%= csp_meta_tag %>

Expected behaviour

To get authenticated.

[carlosantoniodasilva]

Can you provide a sample app that shows the issue?

[tavyy]

<%= form_for(resource, as: resource_name, url: session_path(resource_name)) do |f| %>
  <%= render "devise/shared/error_messages", resource: resource %>

  <div class="input-wrapper">
    <%= f.email_field :email, placeholder: "Enter your mail", autofocus: true, required: true %>
    <%= f.password_field :password, placeholder: "Password" %>
  </div>
  <div class="check-wrapper">
    <!-- <% if devise_mapping.rememberable? %>
      <div class="form-check">
        <%= f.check_box :remember_me, class: "form-check-input" %>
        <%= f.label :remember_me, class: "form-check-label" %>
      </div>
    <% end %>
    <%= link_to('Forgot password?', new_password_path(resource_name)) %> -->
  </div>
  <%= f.button "Sign In", type: "submit", class: 'rts-btn btn-primary' %>
  <p>Don't have an account? <%= link_to('Sign Up', new_registration_path(resource_name), class: 'ml--5') %> </p>
<% end %>

[tavyy]

Jesus Christ. It seems to work only when dev cache is enabled.

[carlosantoniodasilva]

Can you check if the behavior is the same without Devise? (like, with just a Rails form posting to some controller) I don't think it'd have anything to do with the library itself.

[tavyy]

I think the issue is caused by Turbo.

[carlosantoniodasilva]

There's a great chance :), if you learn otherwise, let us know.

[venkat071982]

Hi @tavyy I am also getting same issue, what is fix you have done can pls update here I am also using Same version Ruby 3.2.2 Rails 7.0.8 Devise 4.9.2