plataformatec/devise — Issue #1474: Devise undesirably generates a _session_id cookie when using mobile devise to post data to sign_in_and_redirect
Author: DanielViglione
Created: 2011-11-29 23:05:19+00:00
State: open

Hey all,

I have this method:

class Users::SessionsController < Devise::SessionsController
def sign_in_and_redirect(resource_or_scope, resource=nil)
scope = Devise::Mapping.find_scope!(resource_or_scope)
resource ||= resource_or_scope
sign_in(scope, resource) unless warden.user(scope) == resource
current_user.ensure_authentication_token!
render :json => {:success => true, :auth_token => current_user.authentication_token}.to_json, :status => :ok
end

It successfully returns json when used with Curl program. The data sent to server using Curl program is as follows:

POST /users/sign_in.json HTTP/1.1
User-Agent: curl/7.21.0 (x86_64-pc-linux-gnu) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3.4 libidn/1.18
Host: 172.27.12.134:3000
Accept: */*
Content-Type: application/json
Content-Length: 70

{"user": {"email": "abc@abcdef.net", "password": "abcdef"}}

Now when I try to perform the same exact request (with identical parameters) in the iphone or blackberry, it fails and when looking at the logs, I notice this:

ActionView::MissingTemplate (Missing template home/map with {:handlers=>[:erb, :rjs, :builder, :rhtml, :rxml, :arb, :haml], :formats=>[:json], :locale=>[:en, :en]} in view paths "/Users/xxxxxx/github/xxxxxx/app/views", "/Users/xxxxxx/.rvm/gems/ruby-1.9.2-p290@xxxxxx/gems/client_side_validations-3.0.12/app/views", "/Users/xxxxxx/.rvm/gems/ruby-1.9.2-p290@xxxxxx/gems/activeadmin-0.3.1/app/views", "/Users/xxxxxx/.rvm/gems/ruby-1.9.2-p290@xxxxxx/gems/kaminari-0.12.4/app/views", "/Users/xxxxxx/.rvm/gems/ruby-1.9.2-p290@xxxxxx/gems/devise-1.4.5/app/views"):

And I noticed that the response sent to the server has the addition of a cookie:

POST /users/sign_in.json HTTP/1.1
Host: dev.xxxxxx.com:3000
User-Agent: XKRemote iPhone 1.0 (iPhone Simulator; iPhone OS 5.0; en_US)
Content-Length: 139
Accept: application/json
Content-Type: application/json
Accept-Encoding: gzip
Cookie: _session_id=d41c9ab959dc9198a0d6ef6bebbbacba; remember_user_token=BAhbB1sGaQZJIiIkMmEkMTAkVk54TGkzZE9BMHRrQlNTdTJSOWQyZQY6BkVU--87f556fbc6554cdfa8161e82f7415333daec6c0d
Connection: close

{"remote":"true", "commit":"Sign in", "utf8": "", "user":{"remember_me": "1", "email":"abc@abcdef.net", "password":"abcdef"}}

I believe the cookie is the cause of all this, because the first time I sign in with a user, it works fine, and then the second time and so forth it fails everytime with the same error.

Why is devise generating a cookie here and how can I ensure that it delivers the same response as Curl does? Curl behaves as I expect, but using the iphone and blackberry causes the creation of a cookie called _session_id which holds a value of the session record created in sessions database. This makes no sense to me. I am using authentication token to authenticate users.

Thanks for response