mirror of
https://github.com/rails/rails.git
synced 2022-11-09 12:12:34 -05:00
a500b4796f
I came up against this while dealing with a misconfigured server. The browser was setting the Origin header to "https://example.com", but the Rails app returned "http://example.com" from request.base_url (because it was failing to detect that HTTPS was used). This caused verify_authenticity_token to fail, but the message in the log was "Can't verify CSRF token", which is confusing because the failure had nothing to do with the CSRF token sent in the request. This made it very hard to identify the issue, so hopefully this will make it more obvious for the next person. |
||
|---|---|---|
| .. | ||
| api | ||
| controller_fixtures | ||
| metal | ||
| mime | ||
| new_base | ||
| parameters | ||
| request | ||
| action_pack_assertions_test.rb | ||
| base_test.rb | ||
| caching_test.rb | ||
| content_type_test.rb | ||
| default_url_options_with_before_action_test.rb | ||
| filters_test.rb | ||
| flash_hash_test.rb | ||
| flash_test.rb | ||
| force_ssl_test.rb | ||
| form_builder_test.rb | ||
| helper_test.rb | ||
| http_basic_authentication_test.rb | ||
| http_digest_authentication_test.rb | ||
| http_token_authentication_test.rb | ||
| integration_test.rb | ||
| live_stream_test.rb | ||
| localized_templates_test.rb | ||
| log_subscriber_test.rb | ||
| metal_test.rb | ||
| output_escaping_test.rb | ||
| parameter_encoding_test.rb | ||
| params_wrapper_test.rb | ||
| permitted_params_test.rb | ||
| redirect_test.rb | ||
| render_js_test.rb | ||
| render_json_test.rb | ||
| render_test.rb | ||
| render_xml_test.rb | ||
| renderer_test.rb | ||
| renderers_test.rb | ||
| request_forgery_protection_test.rb | ||
| required_params_test.rb | ||
| rescue_test.rb | ||
| resources_test.rb | ||
| routing_test.rb | ||
| runner_test.rb | ||
| send_file_test.rb | ||
| show_exceptions_test.rb | ||
| streaming_test.rb | ||
| test_case_test.rb | ||
| url_for_integration_test.rb | ||
| url_for_test.rb | ||
| url_rewriter_test.rb | ||
| webservice_test.rb | ||