Rails Devise Calling POST instead of PUT in reset password - ruby-on-rails

Question

I am using devise for authentication and i have a problem in the recover password form, whose link is sent by e-mail. When I define a new password, the form is sending a POST request, instead of a PUT. It's redirecting to user/password# with 'Email can't be blank' notice.
So, edit.html.erb has method: : put, but it isn't working.
<%= form_for(resource, as: resource_name, url: user_password_path(resource_name), html: { method: :put }) do |f| %>
I'm stuck in this all day and haven't figured a way out
This is the full edit.html.erb
<h2>Change your password</h2>
<%= form_for(resource, as: resource_name, url: user_password_path(resource_name), method: :PUT) do |f| %>
<%= render "devise/shared/error_messages", resource: resource %>
<%= f.hidden_field :reset_password_token %>
<div class="field">
<%= f.label :password, "New password" %><br />
<% if #minimum_password_length %>
<em>(<%= #minimum_password_length %> characters minimum)</em><br />
<% end %>
<%= f.password_field :password, autofocus: true, autocomplete: "new-password" %>
</div>
<div class="field">
<%= f.label :password_confirmation, "Confirm new password" %><br />
<%= f.password_field :password_confirmation, autocomplete: "new-password" %>
</div>
<div class="actions">
<%= f.submit "Change my password" %>
</div>
<% end %>
This is the generated form
<h2>Change your password</h2>
<form class="new_user" id="new_user" action="/user/password.user" accept-charset="UTF-8" method="post"><input name="utf8" type="hidden" value="✓" /><input type="hidden" name="_method" value="patch" /><input type="hidden" name="authenticity_token" value="Zf5rxkU11tVmt4i8hDpFPDL5y+/jzRQT/O/si6RnraidCN5vxofmVS1abO4nJ8iqlncZfCRr1jdLjMfxwMx45A==" />
<input type="hidden" value="xk6EkLsyxCyvvpDyY6Ug" name="user[reset_password_token]" id="user_reset_password_token" />
<div class="field">
<label for="user_password">New password</label><br />
<em>(6 characters minimum)</em><br />
<input autofocus="autofocus" autocomplete="new-password" type="password" name="user[password]" id="user_password" />
</div>
<div class="field">
<label for="user_password_confirmation">Confirm new password</label><br />
<input autocomplete="new-password" type="password" name="user[password_confirmation]" id="user_password_confirmation" />
</div>
<div class="actions">
<input type="submit" name="commit" value="Change my password" data-disable-with="Change my password" />
</div>
</form>
My passwords controller
# frozen_string_literal: true
# Deals with user login and generates JWT
class User::PasswordsController < Devise::PasswordsController
prepend_before_action :require_no_authentication
# Render the #edit only if coming from a reset password email link
append_before_action :assert_reset_token_passed, only: :edit
skip_before_action :verify_authenticity_token
respond_to :json
wrap_parameters :user
before_action :configure_permitted_parameters, if: :devise_controller?
def create
super
end
def edit
super
end
def update
super
end
def new
super
end
end
My routes.rb
constraints subdomain: 'api' do
scope module: 'user' do
devise_for :users,
path: '/user',
path_names: {
registration: 'signup',
sign_in: 'login',
sign_out: 'logout'
},
controllers: {
sessions: 'user/sessions',
registrations: 'user/registrations',
passwords: 'user/passwords'
}
Server log
Thanks in advance

Answer 1

I ran into this same issue using the Devise password reset functionality. I was adding Devise to an API Rails application (config.api_only = true) and apparently the Rack::MethodOverride middleware that is responsible for identifying the hidden method attribute and changing the request to a PUT/PATCH request was not included in the API-only middleware stack. As a result, the request made it to the main app still as a POST request.
I added the following line to config/application.rb, which solved the problem:
config.middleware.insert_after Rack::Runtime, Rack::MethodOverride