Nil user in CanCanCan ability.rb

Question

Trying to get an async request working from a React component. However it always fails due to invalid permissions.

Example working request:

Started GET "/" for 127.0.0.1 at 2017-10-04 16:32:00 -0400
Processing by EventsController#index as HTML
  User Load (0.4ms)  SELECT  "users".* FROM "users" WHERE "users"."id" = ? ORDER BY "users"."id" ASC LIMIT ?  [["id", 1], ["LIMIT", 1]]
  Rendering events/index.html.erb within layouts/application

Example failing async request:

Started GET "/events/search?ne_lat=37.82915414554321&ne_lng=-122.13221051635742&sw_lat=37.72060601151162&sw_lng=-122.70658948364257" for 127.0.0.1 at 2017-10-04 16:32:07 -0400
Processing by EventsController#search as */*
  Parameters: {"ne_lat"=>"37.82915414554321", "ne_lng"=>"-122.13221051635742", "sw_lat"=>"37.72060601151162", "sw_lng"=>"-122.70658948364257"}
  ... #NOTE: printing 'user' from byebug in ability.rb shows it as nil
CanCan::AccessDenied (You are not authorized to access this page.):

Note that the failing request does not select/load the user from a DB query. Any ideas what could be going wrong? Ability.rb permissions allow this request, but the user is not being filled out correctly when calling asynchronously.

This request was previously working using jQuery but I've re-written it using fetch .

Here is the controller

class EventsController < ApplicationController
  before_action :set_event, only: [:show, :edit, :update, :destroy]
  load_and_authorize_resource

  def index
    @events = Event.all
  end
  ...
  def search
    local_events = Event.includes(:address).references(:address)
      .where("latitude >= ? AND latitude <= ? AND longitude >= ? AND longitude <= ?",       
          params[:sw_lat], params[:ne_lat], params[:sw_lng], params[:ne_lng]
          )
      .limit(50)

    render json: local_events, only: [:id,:name,:description,:start], include: { address: { only: [:latitude,:longitude,:street_address] }}
  end

end

And the ability.rb

class Ability
  include CanCan::Ability

  def initialize(user)
    can :read, :all
    byebug
    return if user == nil #user must be logged in after this point

    #events
    can [:search], Event
    ...
  end
end

Answer 1

The asynchronous request does not query the user from DB because there is no user ID in the session. There is no user ID in the session, because Fetch API 's fetch does not include cookies by default.

In order to send cookies with a Fetch Request set credentials option to "same-origin" or "include" :

fetch(url, {  
  credentials: 'include'  // or 'same-origin' (see the link below)
})

https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/Using_Fetch#Sending_a_request_with_credentials_included