使用gem devise_token_auth时如何关闭CSRF令牌检查

Question

我想在Rails应用程序（用作API）中关闭CSRF-token检查，因为我想使用gem devise_token_auth处理身份验证

我使我的User.rb模型了解了新的身份验证形式：

class User < ActiveRecord::Base
  has_many :trainings

  extend Devise::Models
  # Include default devise modules. Others available are:
  # :confirmable, :lockable, :timeoutable and :omniauthable
  devise :database_authenticatable, :registerable,
         :recoverable, :rememberable, :trackable, :validatable
  include DeviseTokenAuth::Concerns::User
end

在我的控制器中，我要求进行身份验证：

class Api::V1::TrainingsController < ApplicationController
  before_action :authenticate_user!

我也在使用gem rack-cors来决定谁可以向Rails api发出请求（目前是所有人）

config.middleware.insert_before 0, Rack::Cors do
      allow do
        origins '*'
        resource '*',
        headers: :any,
        methods: [:get, :post, :patch, :delete, :options],
        expose: ['access-token', 'expiry', 'token-type', 'uid', 'client']
      end
    end

第一个问题：如果我注释掉了protect_from_forgery方法：

class ApplicationController < ActionController::Base
  include DeviseTokenAuth::Concerns::SetUserByToken

  # protect_from_forgery with :exception

Rails仍然尝试检查CSRF令牌：

Started POST "/api/v1/import" for 46.128.35.112 at 2019-07-23 05:04:32 +0000
2019-07-23T05:04:32.586008+00:00 app[web.1]: I, [2019-07-23T05:04:32.585930 #4]  INFO -- : [dd02c2bc-1367-474a-81a3-f60740e7a661] Processing by Api::V1::TrainingsController#import as JSON
2019-07-23T05:04:32.586079+00:00 app[web.1]: I, [2019-07-23T05:04:32.586010 #4]  INFO -- : [dd02c2bc-1367-474a-81a3-f60740e7a661]   Parameters: {"uid"=>"1", "training"=>{}}
2019-07-23T05:04:32.586319+00:00 app[web.1]: W, [2019-07-23T05:04:32.586199 #4]  WARN -- : [dd02c2bc-1367-474a-81a3-f60740e7a661] Can't verify CSRF token authenticity.
2019-07-23T05:04:32.586567+00:00 app[web.1]: I, [2019-07-23T05:04:32.586508 #4]  INFO -- : [dd02c2bc-1367-474a-81a3-f60740e7a661] Completed 422 Unprocessable Entity in 0ms (ActiveRecord: 0.0ms)
2019-07-23T05:04:32.587644+00:00 app[web.1]: F, [2019-07-23T05:04:32.587566 #4] FATAL -- : [dd02c2bc-1367-474a-81a3-f60740e7a661]
2019-07-23T05:04:32.587718+00:00 app[web.1]: F, [2019-07-23T05:04:32.587648 #4] FATAL -- : [dd02c2bc-1367-474a-81a3-f60740e7a661] ActionController::InvalidAuthenticityToken (ActionController::InvalidAuthenticityToken):
2019-07-23T05:04:32.587796+00:00 app[web.1]: F, [2019-07-23T05:04:32.587726 #4] FATAL -- : [dd02c2bc-1367-474a-81a3-f60740e7a661]
2019-07-23T05:04:32.587928+00:00 app[web.1]: F, [2019-07-23T05:04:32.587827 #4] FATAL -- : [dd02c2bc-1367-474a-81a3-f60740e7a661] vendor/bundle/ruby/2.4.0/gems/actionpack-5.2.1/lib/action_controller/metal/request_forgery_protection.rb:211:in `handle_unverified_request'
2019-07-23T05:04:32.587930+00:00 app[web.1]: [dd02c2bc-1367-474a-81a3-f60740e7a661] vendor/bundle/ruby/2.4.0/gems/actionpack-5.2.1/lib/action_controller/metal/request_forgery_protection.rb:243:in `handle_unverified_request'
2019-07-23T05:04:32.587931+00:00 app[web.1]: [dd02c2bc-1367-474a-81a3-f60740e7a661] vendor/bundle/ruby/2.4.0/gems/devise-4.6.2/lib/devise/controllers/helpers.rb:255:in `handle_unverified_request'
2019-07-23T05:04:32.587932+00:00 app[web.1]: [dd02c2bc-1367-474a-81a3-f60740e7a661] vendor/bundle/ruby/2.4.0/gems/actionpack-5.2.1/lib/action_controller/metal/request_forgery_protection.rb:238:in `verify_authenticity_token'

正如我们可以看到的：

1) Can't verify CSRF token authenticity
2) vendor/bundle/ruby/2.4.0/gems/actionpack-5.2.1/lib/action_controller/metal/request_forgery_protection.rb:211:in `handle_unverified_request'

如果我注释掉protect_from_forgery ，我不明白为什么会显示此有效性检查

第二个问题：

在此线程中：

在Rails 3中关闭CSRF令牌

有人告诉我跳过方法verify_authenticity_token

skip_before_action :verify_authenticity_token

为了禁用CSRF令牌。

如果我这样做：

class ApplicationController < ActionController::Base
  include DeviseTokenAuth::Concerns::SetUserByToken

  # protect_from_forgery with :exception

  # protect_from_forgery with: :null_session
  skip_before_action :verify_authenticity_token
end

现在，我收到以下错误消息：

Started POST "/api/v1/import" for 46.128.35.112 at 2019-07-23 05:25:55 +0000
2019-07-23T05:25:55.567398+00:00 app[web.1]: I, [2019-07-23T05:25:55.567274 #4]  INFO -- : [e1fb4a4e-e61b-4865-b83e-133d96d6b193] Processing by Api::V1::TrainingsController#import as JSON
2019-07-23T05:25:55.567487+00:00 app[web.1]: I, [2019-07-23T05:25:55.567386 #4]  INFO -- : [e1fb4a4e-e61b-4865-b83e-133d96d6b193]   Parameters: {"uid"=>"1", "training"=>{}}
2019-07-23T05:25:55.574153+00:00 app[web.1]: D, [2019-07-23T05:25:55.574055 #4] DEBUG -- : [e1fb4a4e-e61b-4865-b83e-133d96d6b193]   User Load (1.9ms)  SELECT  "users".* FROM "users" WHERE "users"."uid" = $1 LIMIT $2  [["uid", "1"], ["LIMIT", 1]]
2019-07-23T05:25:55.604617+00:00 app[web.1]: I, [2019-07-23T05:25:55.604516 #4]  INFO -- : [e1fb4a4e-e61b-4865-b83e-133d96d6b193] Filter chain halted as :authenticate_user! rendered or redirected
2019-07-23T05:25:55.604774+00:00 app[web.1]: I, [2019-07-23T05:25:55.604708 #4]  INFO -- : [e1fb4a4e-e61b-4865-b83e-133d96d6b193] Completed 401 Unauthorized in 37ms (Views: 0.4ms | ActiveRecord: 18.8ms)

Completed 401 Unauthorized

看起来更好，因为现在不应用CSRF令牌检查，但是我感觉到我也从gem devise_token_auth禁用了access-token 。

问题：禁用CSRF令牌检查的正确方法是哪一种？ 注释掉protect_from_forgery或添加skip_before_action :verify_authenticity_token吗？

如果正确的方法是skip_before_action :verify_authenticity_token ，那么如果我通过了access-token ，为什么没有通过身份验证？

这是我打电话的方式：

const rawResponse = await fetch('https://plankorailsfour.herokuapp.com/api/v1/import', {
    method: 'POST',
    headers: {
      'Accept': 'application/json',
      'Content-Type': 'application/json',
      'Access-Token': auth.accessToken,
      'token-type': 'Bearer',
      'client': auth.client,
      'uid': '1',
      'X-Requested-With': 'XMLHttpRequest'
    },
    body: JSON.stringify(bodyRequest)
  })

我在登录请求的响应中获得了access-token

Answer 1

发现了错误，当您从rails中获取响应时，您得到了一个uid参数，它不是我想的整数，而是电子邮件...