Browser URL changes after http post fail - ruby-on-rails

Question

I have a login page on which the authentication can be successful or not. Here is the page new.html.erb:
<%=form_with scope: :session, url: sessions_path, local: true, html: {class: "login-form"} do |f| %>
<%= f.label :email, t("session.new.email") %>
<%= f.email_field :email %>
<%= f.label :password, t("session.new.password") %>
<%= f.password_field :password %>
<%= f.submit t('session.new.login'), class: "submit" %>
<% end %>
It is associated to a sessions_controller.rb, which is the following:
class SessionsController < ApplicationController
def create
# Find the user with the matching email
user = User.find_by(email: params[:session][:email].downcase)
# Check the user exists in DB and that the provided password matches
if user && user.authenticate(params[:session][:password])
# Log the user through the session helper
log_in user
# Redirect to the hive
redirect_to ideas_path
else
# The authentication failed. Display an error message
flash.now[:error] = I18n.t('session.new.invalid_credentials')
# The render is done to reinitiate the page
render :new
end
end
end
In my routes.rb, I just have for this purpose:
resources :sessions
When executing rails routes, I have the following declared routes:
Now my problem is on the login fail. In my controller, in this case, I add a message in the flash messages and then re-render the same page new.html.erb. But in the browser, the login request POST has been sent on the url /sessions. The problem is the current URL on my browser becomes /sessions instead of staying on /sessions/new. This is as if the POST request changed the URL in my browser. But this is in fact just an AJAX request, isn't it?
I have found this blog post that wonders the same about this phenomenon (I'm not the author)
I have found a workaround, but I'd prefer avoid using it and understand the bevahior. If i replace my routes by the following, this works:
get '/login', to: 'sessions#new'
post '/login', to: 'sessions#create'
I can understand why this works: the get and post url are the same, so the browser doesn't change its URL.
Have you any idea?
EDIT:
I finally found a solution. I'm not sure this is the "rails way", but this works as expected. I have just changed the controller to do a redirection to the same page, with a flash request to transmit the login fail information:
def create
# Find the user with the matching email
user = User.find_by(email: params[:session][:email].downcase)
# Check the user exists in DB and that the provided password matches
if user && user.authenticate(params[:session][:password])
# Log the user through the session helper
log_in user
# Redirect to the hive
redirect_to ideas_path
else
# The authentication failed. Display an error message through a flash
# message after redirect to the same page
redirect_to new_session_path, alert: I18n.t('session.new.invalid_credentials')
end
end

Answer 1

When the form gets submitted the browser performs a regular HTTP POST requsest to the /sessions endpoint. No AJAX there.
The way your routes are configured this POST request will be handled by your sessions#create action.
Notice the code there. You'll see that the happy path (successful login) calls redirect_to. In case of login errors though, the controller calls render.
The difference is that in the first case the response is a 302 Redirect which the browser follows. That's why you see the URL changing in the browser. In the second case the response is just 200 OK with a bunch of HTML for the browser to render. The URL won't change because the browser wasn't instructed to navigate elsewhere.
Here's an extensive explanation of how redirects work in the browser in case you're interested.