Repository: heartcombo/devise

Issue #2332: ActionController::Live and authenticate_user! fails to catch :warden
Created: 2013-03-15T17:15:44Z
Calling authenticate_user! in a controller that has included ActionController::Live causes ArgumentError (uncaught throw :warden)
Can be reproduced simply with:
class FooController < ApplicationController
  include ActionController::Live
  before_action :authenticate_user!
  def foo; render text: ""; end
end
And then GET'ing foo from the rails console. Example backtrace:
ArgumentError (uncaught throw :warden):
  warden (1.2.1) lib/warden/proxy.rb:128:in `throw'
  warden (1.2.1) lib/warden/proxy.rb:128:in `authenticate!'
  /Users/jamil/.rvm/gems/ruby-2.0.0-p0@tmp/bundler/gems/devise-d29b744d92a3/lib/devise/controllers/helpers.rb:48:in `authenticate_user!'
  activesupport (4.0.0.beta1) lib/active_support/callbacks.rb:407:in `_run__624670321848815552__process_action__callbacks'
  activesupport (4.0.0.beta1) lib/active_support/callbacks.rb:78:in `run_callbacks'
  actionpack (4.0.0.beta1) lib/abstract_controller/callbacks.rb:17:in `process_action'
  actionpack (4.0.0.beta1) lib/action_controller/metal/rescue.rb:29:in `process_action'
  actionpack (4.0.0.beta1) lib/action_controller/metal/instrumentation.rb:31:in `block in process_action'
  activesupport (4.0.0.beta1) lib/active_support/notifications.rb:158:in `block in instrument'
  activesupport (4.0.0.beta1) lib/active_support/notifications/instrumenter.rb:20:in `instrument'
  activesupport (4.0.0.beta1) lib/active_support/notifications.rb:158:in `instrument'
  actionpack (4.0.0.beta1) lib/action_controller/metal/instrumentation.rb:30:in `process_action'
  actionpack (4.0.0.beta1) lib/action_controller/metal/params_wrapper.rb:245:in `process_action'
  activerecord (4.0.0.beta1) lib/active_record/railties/controller_runtime.rb:18:in `process_action'
  actionpack (4.0.0.beta1) lib/abstract_controller/base.rb:136:in `process'
  actionpack (4.0.0.beta1) lib/abstract_controller/rendering.rb:44:in `process'
  actionpack (4.0.0.beta1) lib/action_controller/metal/live.rb:118:in `block in process'


  Rendered /Users/jamil/.rvm/gems/ruby-2.0.0-p0@tmp/gems/actionpack-4.0.0.beta1/lib/action_dispatch/middleware/templates/rescues/_source.erb (0.5ms)
  Rendered /Users/jamil/.rvm/gems/ruby-2.0.0-p0@tmp/gems/actionpack-4.0.0.beta1/lib/action_dispatch/middleware/templates/rescues/_trace.erb (0.9ms)
  Rendered /Users/jamil/.rvm/gems/ruby-2.0.0-p0@tmp/gems/actionpack-4.0.0.beta1/lib/action_dispatch/middleware/templates/rescues/_request_and_response.erb (0.8ms)
  Rendered /Users/jamil/.rvm/gems/ruby-2.0.0-p0@tmp/gems/actionpack-4.0.0.beta1/lib/action_dispatch/middleware/templates/rescues/diagnostics.erb within rescues/layout (15.7ms)
 => 500 

Using:
Rails 4.0.0.beta1
Devise rails4 branch
Warden 1.2.1
I've created a simple example app to highlight the issue: https://github.com/jamillion/devise_bug_demo
I'm guessing ActionController::Live is doing something weird with the Rack middleware that causes a catch :warden call to be bypassed in Devise / Warden?

Duplicate issue #5285: Devise tests hang when a controller using ActionController::Live calls authenticate_user!
Created: 2020-08-26T00:44:53Z
Current behavior
Given a streaming controller that uses authenticate_user!:
class MyController < ApplicationController
  include ActionController::Live
  before_action :authenticate_user!
  ...
end
controller tests will hang when authentication fails. This is because #_process_unauthenticated is setting the response body with @controller.response.body= rather than @controller.response_body=. The subtle difference is that ActionController::Live overrides @controller.response_body= to close the stream after setting the body; if the stream isn't closed, the thread will hang indefinitely.
Expected behavior
Does not hang indefinitely. :)
I've got a PR coming in a few minutes.

Closing comment (2020-08-26T00:50:53Z): Also, just in case there's any confusion: this is not related to #2332 (uncaught throw :warden). This issue only applies in tests, whereas #2332 only affects non-test environments.