Can't verify CSRF token authenticity.

[JonaMX]

I have a rails 5.2.1 API-mode application and whenever I send a POST request to get a new JWT token I'm receiving a Can't verify CSRF token authenticity. error, which doesn't make sense since the CSRF token validation is disabled in a API mode.

here's my user_token_controller.rb

class UserTokenController < Knock::AuthTokenController
end

here's my application_controller.rb

class ApplicationController < ActionController::API
	include Knock::Authenticable
end

here's my config/initialiazers/knock.rb

Knock.setup do |config|
  Rails.application.secrets.auth0_client_secret }
end

Here's the error trace

Started POST "/user_token" for 127.0.0.1 at 2018-09-11 10:13:24 -0500
Processing by UserTokenController#create as */*
  Parameters: {"auth"=>{"email"=>"jonatan@tangosource.com", "password"=>"[FILTERED]"}, "user_token"=>{"auth"=>{"email"=>"jonatan@tangosource.com", "password"=>"[FILTERED]"}}}
Can't verify CSRF token authenticity.
Completed 422 Unprocessable Entity in 1ms (ActiveRecord: 0.0ms)



ActionController::InvalidAuthenticityToken (ActionController::InvalidAuthenticityToken):

actionpack (5.2.1) lib/action_controller/metal/request_forgery_protection.rb:211:in `handle_unverified_request'
actionpack (5.2.1) lib/action_controller/metal/request_forgery_protection.rb:243:in `handle_unverified_request'
actionpack (5.2.1) lib/action_controller/metal/request_forgery_protection.rb:238:in `verify_authenticity_token'
activesupport (5.2.1) lib/active_support/callbacks.rb:426:in `block in make_lambda'
activesupport (5.2.1) lib/active_support/callbacks.rb:198:in `block (2 levels) in halting'
actionpack (5.2.1) lib/abstract_controller/callbacks.rb:34:in `block (2 levels) in <module:Callbacks>'
activesupport (5.2.1) lib/active_support/callbacks.rb:199:in `block in halting'
activesupport (5.2.1) lib/active_support/callbacks.rb:513:in `block in invoke_before'
activesupport (5.2.1) lib/active_support/callbacks.rb:513:in `each'
activesupport (5.2.1) lib/active_support/callbacks.rb:513:in `invoke_before'
activesupport (5.2.1) lib/active_support/callbacks.rb:131:in `run_callbacks'
actionpack (5.2.1) lib/abstract_controller/callbacks.rb:41:in `process_action'
actionpack (5.2.1) lib/action_controller/metal/rescue.rb:22:in `process_action'
actionpack (5.2.1) lib/action_controller/metal/instrumentation.rb:34:in `block in process_action'
activesupport (5.2.1) lib/active_support/notifications.rb:168:in `block in instrument'
activesupport (5.2.1) lib/active_support/notifications/instrumenter.rb:23:in `instrument'
activesupport (5.2.1) lib/active_support/notifications.rb:168:in `instrument'
actionpack (5.2.1) lib/action_controller/metal/instrumentation.rb:32:in `process_action'
actionpack (5.2.1) lib/action_controller/metal/params_wrapper.rb:256:in `process_action'
activerecord (5.2.1) lib/active_record/railties/controller_runtime.rb:24:in `process_action'
actionpack (5.2.1) lib/abstract_controller/base.rb:134:in `process'
actionview (5.2.1) lib/action_view/rendering.rb:32:in `process'
actionpack (5.2.1) lib/action_controller/metal.rb:191:in `dispatch'
actionpack (5.2.1) lib/action_controller/metal.rb:252:in `dispatch'
actionpack (5.2.1) lib/action_dispatch/routing/route_set.rb:52:in `dispatch'
actionpack (5.2.1) lib/action_dispatch/routing/route_set.rb:34:in `serve'
actionpack (5.2.1) lib/action_dispatch/journey/router.rb:52:in `block in serve'
actionpack (5.2.1) lib/action_dispatch/journey/router.rb:35:in `each'
actionpack (5.2.1) lib/action_dispatch/journey/router.rb:35:in `serve'
actionpack (5.2.1) lib/action_dispatch/routing/route_set.rb:840:in `call'
rack (2.0.5) lib/rack/etag.rb:25:in `call'
rack (2.0.5) lib/rack/conditional_get.rb:38:in `call'
rack (2.0.5) lib/rack/head.rb:12:in `call'
activerecord (5.2.1) lib/active_record/migration.rb:559:in `call'
actionpack (5.2.1) lib/action_dispatch/middleware/callbacks.rb:28:in `block in call'
activesupport (5.2.1) lib/active_support/callbacks.rb:98:in `run_callbacks'
actionpack (5.2.1) lib/action_dispatch/middleware/callbacks.rb:26:in `call'
actionpack (5.2.1) lib/action_dispatch/middleware/executor.rb:14:in `call'
actionpack (5.2.1) lib/action_dispatch/middleware/debug_exceptions.rb:61:in `call'
actionpack (5.2.1) lib/action_dispatch/middleware/show_exceptions.rb:33:in `call'
railties (5.2.1) lib/rails/rack/logger.rb:38:in `call_app'
railties (5.2.1) lib/rails/rack/logger.rb:26:in `block in call'
activesupport (5.2.1) lib/active_support/tagged_logging.rb:71:in `block in tagged'
activesupport (5.2.1) lib/active_support/tagged_logging.rb:28:in `tagged'
activesupport (5.2.1) lib/active_support/tagged_logging.rb:71:in `tagged'
railties (5.2.1) lib/rails/rack/logger.rb:26:in `call'
actionpack (5.2.1) lib/action_dispatch/middleware/remote_ip.rb:81:in `call'
actionpack (5.2.1) lib/action_dispatch/middleware/request_id.rb:27:in `call'
rack (2.0.5) lib/rack/runtime.rb:22:in `call'
activesupport (5.2.1) lib/active_support/cache/strategy/local_cache_middleware.rb:29:in `call'
actionpack (5.2.1) lib/action_dispatch/middleware/executor.rb:14:in `call'
actionpack (5.2.1) lib/action_dispatch/middleware/static.rb:127:in `call'
rack (2.0.5) lib/rack/sendfile.rb:111:in `call'
rack-cors (1.0.2) lib/rack/cors.rb:97:in `call'
railties (5.2.1) lib/rails/engine.rb:524:in `call'
puma (3.12.0) lib/puma/configuration.rb:225:in `call'
puma (3.12.0) lib/puma/server.rb:658:in `handle_request'
puma (3.12.0) lib/puma/server.rb:472:in `process_client'
puma (3.12.0) lib/puma/server.rb:332:in `block in run'
puma (3.12.0) lib/puma/thread_pool.rb:133:in `block in spawn_thread'

I think that the error could be because the Knock::ApplicationController is inherited from ActionController::Base https://github.com/nsarno/knock/blob/master/app/controllers/knock/application_controller.rb#L2 and not from ActionController::API but I'm not Rails expert, so I'm not sure about it

[JamesAndresCM]

Add

skip_before_action :verify_authenticity_token

in your user_token_controller.rb

[andrerpbts]

#248 will handle this change 😃

Closing this one 👍