plataformatec/devise — Issue #1546: Devise Returns 401 Unauthorized status when in development mode using token_authenticatable.
Author: gbluv
Created: 2012-01-03 17:54:42+00:00
State: open

Hi,

This are my gem versions:

rails 3.1.1 warden-1.1.0 devise-1.5.3 orm_adapter-0.0.5

I am running app using apache and passenger:

Server: Apache/2.2.20 (Unix) DAV/2 PHP/5.3.6 with Suhosin-Patch mod_jk/1.2.32 Phusion_Passenger/3.0.9
X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 3.0.9

This is the curl example:

curl -H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-X POST http://test.com/confirmations \
-d '{"auth_token": "auth_token", "plan": {"text": "some confirmation text", "description":"created via curl"}}'

I am seeing further described behavior only in DEVELOPMENT mode.

First time after restart rails returns 401 Unauthorized status with this json:

{"error":"You need to sign in or sign up before continuing."}

However all of the consecutive calls work fine.

I've also noticed that on every request I get the WARNING: Can't verify CSRF token authenticity
I am intending to use parts of the application as an api there for I won't be able to pass csrf tokens to the user. Also, I've tried removing protect_from_forgery but the behavior remained.

Hope this helps.

Sincerely,

Greg Bluvshteyn