Why does destroy action trigger HTTP authentication in Production in Rails 3?

Question

Screenshot of what happens when I press 'delete': http://twitpic.com/4mljuy

This is what I see in my production.log:

Started POST "/clients/1" for 127.0.0.1 at 2011-04-20 13:48:26 -0500
  Processing by ClientsController#destroy as JSON
  Parameters: {"id"=>"1"}
nil
Completed   in 3ms

This is my destroy action in my controller:

def destroy
     client = Client.find(params[:id])
     client.destroy
     respond_to do |format|
        format.html { redirect_to("/") }
        format.js   { render :json => ['client',params[:id]].to_json, :layout => false }
    end
end

This is the delete link in my view:

<span class="icon destroy-icon" data-destroy-title="Delete <%= client.email %>?" data-destroy-url="<%= client_path(client) %>" data-compv-mapping="clientDestroyFn" title="Delete"> </span>

Here is the JS:

$('[data-destroy-url]').live('click', function(e){
    console.debug("Clicked Destroy");
    var element = $(this);
    var mapping = compv.tools.getVariableFromString(element.attr("data-compv-mapping"), compv);
    var dialog = $("div#" + mapping.dialog);
    dialog.dialog('option', 'title', element.attr("data-destroy-title"));
    dialog.dialog("option", 
        "buttons", [
        { text: "No",
          click: function(){
            dialog.dialog('close');
        }
        },
    { text: "Yes, do it!",
      click: function() {
        dialog.dialog('close');
        $.destroy({
            url: element.attr('data-destroy-url'),
            success: mapping.success
        });
    }}
    ]);
    dialog.dialog('open');
});

Btw, this only happens when RAILS_ENV=production and not development.

Edit: Here is my application controller:

class ApplicationController < ActionController::Base
  helper :all
  helper_method :current_user, :logged_in?

  protect_from_forgery
  before_filter :set_current_user
  before_filter :authenticate_user!

  def set_xhr_flash
    flash.discard if request.xhr?
  end

  def correct_safari_and_ie_accept_headers
    ajax_request_types = ['text/javascript', 'application/json', 'text/xml']
    request.accepts.sort! { |x, y| ajax_request_types.include?(y.to_s) ? 1 : -1 } if request.xhr?
  end

  protected 

  def set_current_user
    logger.info current_user.inspect
    Authorization.current_user = current_user
    #User.current = current_user
  end

    # def after_sign_in_path_for(resource)
    #       if resource.is_a?(User) && resource.has_trial_expired?
    #           return url_for(:settings)
    #       end
    #       super       
    #   end

end

Edit2: When I tried to delete a stage (which is an object), I got this message in my log file:

Started POST "/stages/58" for 127.0.0.1 at 2011-04-20 23:18:13 -0500
  Processing by StagesController#destroy as JSON
  Parameters: {"id"=>"58"}
  User Load (1.6ms)  SELECT "users".* FROM "users" WHERE "users"."id" = 11 LIMIT 1
nil
Permission denied: No matching rules found for destroy for #<Authorization::AnonymousUser:0x000001052659c0 @role_symbols=[:guest]> (roles [:guest], privileges [:destroy], context :stages).
Rendered text template (0.0ms)
Completed 403 Forbidden in 232ms (Views: 0.9ms | ActiveRecord: 1.6ms)

Pretty sure this has nothing to do with your code, and there is either a middleware or web-server setting you need to check — Unixmonkey, Apr 20 '11 at 21:23
Well the thing is, I first encountered this when I pushed the code to Heroku. Once it was in production it did this, then I duplicated it in production environment on my local machine. However, now that I have duplicated it locally, it now happens in `RAILS_ENV=development` too. So not sure what's up. — marcamillion, Apr 21 '11 at 00:54
After much backing and forthing, I have finally figured out that some release between `rails 3.0.0` to `3.0.7` is what is causing this issue. Not sure how to fix it yet. — marcamillion, Apr 23 '11 at 01:22
Are you sending the proper authorization_token along with your POST request? I don't see it anywhere in your JS code, but it could just be elsewhere. — mistagrooves, Apr 23 '11 at 02:24

score 1 · Accepted Answer · answered Apr 23 '11 at 02:15

1

Update to the latest jquery ujs driver which includes the CSRF token in each request to prevent your session from being reset since the changes in 3.0.4.

answered Apr 23 '11 at 02:15

Samuel

37,778
11
85
87

For anyone else struggling with this, all version 3.0.4 and above causes it to go funky. So just copy and paste this https://github.com/rails/jquery-ujs/blob/master/src/rails.js to your `rails.js` in your `javascripts` folder and you should be good to go. – marcamillion Apr 23 '11 at 02:19

score 0 · Answer 2 · answered Apr 20 '11 at 22:10

0

You probably have a before filter on the application controller or on your controller with basic auth requested.

Or, do you have any gems for authenication?

answered Apr 20 '11 at 22:10

Dominic

1,294
1
15
29

I am using devise. Other than that...nothing that I know of. – marcamillion Apr 21 '11 at 00:46
Btw, login functionality is definitely acting weird. Sometimes I will try to login, and it will redirect me to the home page - not logged in. Then I have to try login again and it works. Not sure if it is something to do with my cache or what, but it's acting screwy. – marcamillion Apr 21 '11 at 00:55

Why does destroy action trigger HTTP authentication in Production in Rails 3?

2 Answers2

Linked