I am trying to follow the ruby-saml example code for doing the outbound redirect and am hitting a CORs exception.
The code in question is:
request = OneLogin::RubySaml::Authrequest.new redirect_to(request.create(saml_settings))
When I try to call this via axios, I get an OPTIONS preflight which rejects me with a 302 and
Response to preflight request doesn't pass access control check: Redirect is not allowed for a preflight request.
So far, I have tried rack-cors, rails-reverse-proxy and a number of other things but I cannot get past this block.
Does anyone have some good instructions on how to fix this? Why is the redirect not being handled as a simple request? i.e. Why am I getting the OPTIONS preflight? Can I somehow make this a simple request?
Someone was saying that I will need to proxy through something like nginx but that seems overkill this.
rails 6, react if it matters.
The error you are experiencing is not related to SAML.
This is related to the fact that you are executing a redirection to a website which hostname mismatch the rails server hostname and the headers that are added on the request.
CORS explanation: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
You need to review your rack-cors settings as well as review if your Apache/Nginx configuration is configured properly.
https://enable-cors.org/server.html
I have been struggling for a long while trying to determine the correct approach to use the omniauth-facebook gem.
I am running my API on port 3001 while my frontend (in my case coded on ReactJS) is running on port 3000. As per what I have been researching, this is a common issue but there is not a clear answer nor documentation here. I am not expecting to use any additional SDK as I understand that this gem should handle all I need to simply login through FB.
When manually running on the browser http://localhost:3001/auth/facebook, I can see on Rails console that route is being hit and things are moving forward as expected; also, I am seeing that callback route is hit and I am getting back a JSON with UID, client and auth_token.
However, when trying to reach this through my react app, I am getting a CORS error. I am simply making an AXIOS.get(/auth/facebook) which gets routed into my API as I have configured the proxy to pass calls received on my frontend into the API. My console seems to be hit by my request as I am seeing the following:
However, on the Chrome console, I am seeing a CORS issue as per the following image:
For sure, I have already tried adding the following code snippet and still getting the same error:
Having said this, could someone answer me the following questions:
which is the expected way to trigger the initial call into /auth/facebook route? Kindly do not FW me to read the main repo doc as it does not say this solution there.
has someone solved the present issue on a way which is not by adding a link into http://localhost:3001/auth/facebook? Would this be a correct approach? It sounds weird to me.
I have a Rails app that uses the gem Httparty. It makes a call to Stubhub's API with a base URI of https://api.stubhub.com. The app behaves as expected locally and makes successful calls. However, when deployed to Heroku I get 403 forbidden error -- it is making the request to http instead of https. Is Heroku forcing the GET request to an http endpoint? Why? How can I fix this?
Thanks!
I have been struggling with a similar issue for months now. It recently came to my attention that the SSL version could cause this timeout. Using HTTParty I resolved this like this:
HTTParty.get('url_here', ssl_version: :SSLv3).body
I am unsure as to which ssl_version token you will need, but in my case, this fixed the problem. Take a look here for a little more information about where this came from:
https://github.com/jnunemaker/httparty/issues/257
A warning: SSLv3 is not secure, but that does not stop people from continuing to use it.
I'm working on a Rails application that works with data via the Shopify API, however it has just started giving me 500 errors when certain resources are requested via a proxy (as set in the app settings in Shopify).
The request is along the lines of:
/app/my-application/customers/1234.json
however the error log on Heroku is showing a GET request to:
/app/my-application/cusotmers,1234.json
I'm using the Shopify/shopify_api gem which was recently updated, otherwise nothing else in the config/routes has changed since this error began occurring.
Any help or pointers greatly appreciated!
I'll happily provide more information if anything relevant is missing above.
This was a bug in Shopify's service to proxy requests to applications.
I have just deployed a fix for the issue. I take full responsibility for the issue, and will try to improve our tests to avoid similar issues in the future.
We're using EngineYard Cloud to deploy our Ruby on Rails application. We are running Rails v2.3.3.
EngineYard Cloud deploys to AWS instances in a manner similar to Capistrano. After each deploy, we're running into Invalid Authenticity Token errors. Specifically, any user that has previously visited our application and then visits after the deploy and then tries to submit a form gets an invalid authenticity token error. This error persists until they reset their cookies for the site. After they reset their cookies, the site works as expected with no errors.
We are using ActiveRecord's session store and sessions are being saved to the database.
This is the error we are seeing:
ActionController::InvalidAuthenticityToken
/usr/lib/ruby/gems/1.8/gems/actionpack-2.3.3/lib/action_controller/request_forgery_protection.rb:79:in `verify_authenticity_token'
The session object is nil after the deploy, however, the session data still persists in the database and the session ID cookie still exists:
Session:
session id: nil
data: nil
We haven't been able to explain this one. Any thoughts on what could be the root cause?
Thanks for any suggestions!
EDIT: Just to update on this, we've been able to isolate an example of the error.
1) User loads form
2) Code is updated on server
3) User submits form
** Invalid Authenticity Token error occurs
It seems that when the environment changes, Rails is unable to handle this with the authenticity token.
We've tried several steps to resolve:
Resetting the session
Deleting the session cookie (both in JavaScript and Rails)
Wiping the session table in the database after deploying code
Nothing works. The only thing that works is having the user clear their cookies client-side.
(We've been Googling (even tried Binging!) for answers, but no dice. This seems to be a similar related issue: http://railsforum.com/viewtopic.php?id=21479)
Also: initially we thought this was isolated to our deployment to EngineYard, but we've also been able to reproduce it on our development server that we deploy to via Capistrano.
Any thoughts would be gratefully accepted.
Thanks!
ANSWER: After extensive work by EngineYard (they're awesome!) they were able to diagnose the issue. The root cause of this issue is a bug with mongrel clusters. Mongrel doesn't seem to see the first post request after being started. EngineYard did extensive work to diagnose this:
There doesn't appear to be anything in your code causing the issue and I have found people outside of our environment that have experienced the bug as well (http://www.thought-scope.com/2009/07/mongrelcluster-rails-23x-bad-post.html). I suppose a lot of people don't see it because the first request to a site generally isn't a post or they chalk it up to flukes.
[There is a potential workaround using CURL.] The curl work around would do a simple GET request to each of your mongrels on the server to prime them so to speak. You could do this with capistrano, but that won't work if you deploy via the dashboard. You can find a short section on deploy hooks we have built into the infrastructure here:
https://cloud-support.engineyard.com/faqs/overview/getting-started-with-engine-yard-cloud
Adding a simple run curl http://localhost:500x > /dev/null should work (where x is the port you have 5000-50005 on your current setup).
We have addressed the issue by switching our stack from Mongrel to Passenger, but apparently, a fix for Mongrel is in the works. Hopefully, this helps someone who sees this same strange issue.
The authenticity token is a hidden field on the form that rails checks when the form is submitted to ensure that the post data is coming from a live session.
It is there as a security measure to prevent malicious people from using a form submit on their site to say a delete action on someones account.
You can turn it off on your whole app by adding this to config/environment.rb
config.action_controller.allow_forgery_protection = false
You can turn it off a single controller using
skip_before_filter :verify_authenticity_token
or turn it on
protect_from_forgery :except => :index
check out the ActionController::RequestForgeryProtection::ClassMethods docs for more details
It sounds like the secret key used for authentication is changing when you redeploy, invalidating all existing sessions.
Do you have the configuration parameter config.action_controller.session set anywhere, and if you do, is there anything which would cause it to change when you redeploy?
One of my apps has it configured in config/environment.rb, and a more recent one (generated with Rails 2.3) has it set in config/initializers/session_store.rb. The setting looks like:
config.action_controller.session = {
:secret => 'long-string-of-hex-digits'
}
If you don't have this configured for some reason, rake secret will generate a key for you, which can then be inserted into your configuration.
(If it is — and it's not being changed by your deployment processes — then I have no idea what's going on.)
If it would only be there for mongrels! I'm getting the exact same error on passenger as well (user loads form, deploy, submit -> invalid authenticity token). It'd be interesting to know how you solved the issue by switching to passenger? Any further hints are highly welcome. I'll have a closer look as well...
Cheers!
Have encountered this same problem with Rails 2.3 and a Mongrel cluster where the session secret is definitely set in the session initializer. The problem occured even after clearing the client cookies on the client.
However the suggestion of doing a curl get request across all the mongrels after they restart appears to work - thank goodness someone figured this out because it appears to be pretty darned obscure.
The only added info I can supply we are using Apache mod_proxy_balancer along with https in front of our Mongrels, however this problem was occuring before we turned on SSL. Is anyone seeing this with haproxy as the balancer instead of Apache?
This solved this issue for me :-) :-) :-)
https://rails.lighthouseapp.com/projects/8994-ruby-on-rails/tickets/4690-mongrel-doesnt-work-with-rails-238#ticket-4690-37 Posted by Mike Bethany
August 30th, 2010 # 06:43 PM.
I've never gone to any length to figure out the details, but for me, this is a client-side data rot issue. If I've been messing around with the way I store my sessions (and therefore, my authorization details,) I get this error from time to time. Clearing out the private browser data; cookies, authenticated sessions, the works, has always solved it for me.
Hope this helps.