Rails 4: InvalidAuthenticityToken

Question

I am on the site of my app: subdomain.lvh.me:3000/new with

= link_to "Delete", item_url(@item, subdomain: ""), method: :delete

If I click on that link, I get redirected to the right url but I get this error:

ActionController::InvalidAuthenticityToken in ItemsController#destroy ActionController::InvalidAuthenticityToken

Sidenotes:

• I am using devise to handle users.
• A Local storage object gets created for http://lvh.me:3000/

Any idea why this is happening? Devise itself works across all subdomains.

Log:

Started DELETE "/items/322146979" for 127.0.0.1 at 2016-12-13 18:03:18 +0100
Processing by ItemsController#destroy as HTML
  Parameters: {"subdomain"=>"", "id"=>"322146979"}
Can't verify CSRF token authenticity
Completed 422 Unprocessable Entity in 1ms (ActiveRecord: 0.0ms)

Answer 1

I think it's not because of the Devise, youre passing subdomain as empty, so it redirects_to http://lvh.me:3000/ and you're on http://subdomain.lvh.me:3000 . So it's considering as a separate site. So it raised a CSRF authenticity token.