Devise doesn't play well with Apartment after password failure

[vronin]

Environment

• Ruby 2.4.2
• Rails 5.1.5
• Devise 4.4.3
• Apartment 2.1.0

Current behavior

I am pretty sure that everybody know about apartment gem. However, for completeness sake, apartment gem (https://github.com/influitive/apartment) provides multitenancy for Rails and ActiveRecord.

I am using both devise and apartment gem. They play nicely with each other. However, I just stumbled on one use case, when they don't.

1) I open a sign in page

• HTTP GET
• SessionsController#new is executed.
• Apartment works correctly and puts into a correct tenant.

2) I enter a password and click Sign in

• HTTP POST
• SessionsController#create
• Apartment works correctly and puts into the correct tenant

3) The password is incorrect

• SessionsController#create is "Completed 401 Unauthorized"
• SessionsController#new is called (It's called via "recall", meaning that there is no new HTTP request and just another action on another controller called)
• Apartment isn't executed for this SessionsController#new and code isn't placed into a correct tenant. (as result, any tenant related functionality throws).

[vronin]

I have no idea whether it's a devise or apartment problem. It feels like devise issue. However, let me cross reference this issue raised in both gems: https://github.com/plataformatec/devise/issues/4835

[abartier]

Hi,

I'm running the same versions as you except for pg (9.6). And I can't reproduce what you're seeing. I remember that their are few things to do to play nice with Devise and Apartment have you check those:

• https://github.com/influitive/apartment#middleware-considerations
• https://github.com/influitive/apartment/issues/340

Maybe you'll find something, your issue remind me the #340

[vronin]

@abartier Yes. The issue end up being the order of middleware. Closing it. Thanks.