0

我正在尝试关闭CSRF-tokenRails 应用程序（用作 API）中的检查，因为我想使用gem devise_token_auth

我让我的User.rb模型了解了新的身份验证形式：

class User < ActiveRecord::Base
  has_many :trainings

  extend Devise::Models
  # Include default devise modules. Others available are:
  # :confirmable, :lockable, :timeoutable and :omniauthable
  devise :database_authenticatable, :registerable,
         :recoverable, :rememberable, :trackable, :validatable
  include DeviseTokenAuth::Concerns::User
end

在我的控制器中，我要求进行身份验证：

class Api::V1::TrainingsController < ApplicationController
  before_action :authenticate_user!

我也在使用gem rack-cors来决定谁可以向 Rails api 提出请求（暂时是每个人）

config.middleware.insert_before 0, Rack::Cors do
      allow do
        origins '*'
        resource '*',
        headers: :any,
        methods: [:get, :post, :patch, :delete, :options],
        expose: ['access-token', 'expiry', 'token-type', 'uid', 'client']
      end
    end

第一个问题：如果我注释掉方法protect_from_forgery：

class ApplicationController < ActionController::Base
  include DeviseTokenAuth::Concerns::SetUserByToken

  # protect_from_forgery with :exception

Rails 仍然尝试检查 CSRF 令牌：

Started POST "/api/v1/import" for 46.128.35.112 at 2019-07-23 05:04:32 +0000
2019-07-23T05:04:32.586008+00:00 app[web.1]: I, [2019-07-23T05:04:32.585930 #4]  INFO -- : [dd02c2bc-1367-474a-81a3-f60740e7a661] Processing by Api::V1::TrainingsController#import as JSON
2019-07-23T05:04:32.586079+00:00 app[web.1]: I, [2019-07-23T05:04:32.586010 #4]  INFO -- : [dd02c2bc-1367-474a-81a3-f60740e7a661]   Parameters: {"uid"=>"1", "training"=>{}}
2019-07-23T05:04:32.586319+00:00 app[web.1]: W, [2019-07-23T05:04:32.586199 #4]  WARN -- : [dd02c2bc-1367-474a-81a3-f60740e7a661] Can't verify CSRF token authenticity.
2019-07-23T05:04:32.586567+00:00 app[web.1]: I, [2019-07-23T05:04:32.586508 #4]  INFO -- : [dd02c2bc-1367-474a-81a3-f60740e7a661] Completed 422 Unprocessable Entity in 0ms (ActiveRecord: 0.0ms)
2019-07-23T05:04:32.587644+00:00 app[web.1]: F, [2019-07-23T05:04:32.587566 #4] FATAL -- : [dd02c2bc-1367-474a-81a3-f60740e7a661]
2019-07-23T05:04:32.587718+00:00 app[web.1]: F, [2019-07-23T05:04:32.587648 #4] FATAL -- : [dd02c2bc-1367-474a-81a3-f60740e7a661] ActionController::InvalidAuthenticityToken (ActionController::InvalidAuthenticityToken):
2019-07-23T05:04:32.587796+00:00 app[web.1]: F, [2019-07-23T05:04:32.587726 #4] FATAL -- : [dd02c2bc-1367-474a-81a3-f60740e7a661]
2019-07-23T05:04:32.587928+00:00 app[web.1]: F, [2019-07-23T05:04:32.587827 #4] FATAL -- : [dd02c2bc-1367-474a-81a3-f60740e7a661] vendor/bundle/ruby/2.4.0/gems/actionpack-5.2.1/lib/action_controller/metal/request_forgery_protection.rb:211:in `handle_unverified_request'
2019-07-23T05:04:32.587930+00:00 app[web.1]: [dd02c2bc-1367-474a-81a3-f60740e7a661] vendor/bundle/ruby/2.4.0/gems/actionpack-5.2.1/lib/action_controller/metal/request_forgery_protection.rb:243:in `handle_unverified_request'
2019-07-23T05:04:32.587931+00:00 app[web.1]: [dd02c2bc-1367-474a-81a3-f60740e7a661] vendor/bundle/ruby/2.4.0/gems/devise-4.6.2/lib/devise/controllers/helpers.rb:255:in `handle_unverified_request'
2019-07-23T05:04:32.587932+00:00 app[web.1]: [dd02c2bc-1367-474a-81a3-f60740e7a661] vendor/bundle/ruby/2.4.0/gems/actionpack-5.2.1/lib/action_controller/metal/request_forgery_protection.rb:238:in `verify_authenticity_token'

正如我们可以看到的那样：

1) Can't verify CSRF token authenticity
2) vendor/bundle/ruby/2.4.0/gems/actionpack-5.2.1/lib/action_controller/metal/request_forgery_protection.rb:211:in `handle_unverified_request'

如果我注释掉，我不明白为什么会出现这种有效性检查protect_from_forgery

第二个问题：

在这个线程中：

在 Rails 3 中关闭 CSRF 令牌

我被告知跳过该方法verify_authenticity_token

skip_before_action :verify_authenticity_token

为了禁用 CSRF 令牌。

如果我这样做：

class ApplicationController < ActionController::Base
  include DeviseTokenAuth::Concerns::SetUserByToken

  # protect_from_forgery with :exception

  # protect_from_forgery with: :null_session
  skip_before_action :verify_authenticity_token
end

现在我收到以下错误消息：

Started POST "/api/v1/import" for 46.128.35.112 at 2019-07-23 05:25:55 +0000
2019-07-23T05:25:55.567398+00:00 app[web.1]: I, [2019-07-23T05:25:55.567274 #4]  INFO -- : [e1fb4a4e-e61b-4865-b83e-133d96d6b193] Processing by Api::V1::TrainingsController#import as JSON
2019-07-23T05:25:55.567487+00:00 app[web.1]: I, [2019-07-23T05:25:55.567386 #4]  INFO -- : [e1fb4a4e-e61b-4865-b83e-133d96d6b193]   Parameters: {"uid"=>"1", "training"=>{}}
2019-07-23T05:25:55.574153+00:00 app[web.1]: D, [2019-07-23T05:25:55.574055 #4] DEBUG -- : [e1fb4a4e-e61b-4865-b83e-133d96d6b193]   User Load (1.9ms)  SELECT  "users".* FROM "users" WHERE "users"."uid" = $1 LIMIT $2  [["uid", "1"], ["LIMIT", 1]]
2019-07-23T05:25:55.604617+00:00 app[web.1]: I, [2019-07-23T05:25:55.604516 #4]  INFO -- : [e1fb4a4e-e61b-4865-b83e-133d96d6b193] Filter chain halted as :authenticate_user! rendered or redirected
2019-07-23T05:25:55.604774+00:00 app[web.1]: I, [2019-07-23T05:25:55.604708 #4]  INFO -- : [e1fb4a4e-e61b-4865-b83e-133d96d6b193] Completed 401 Unauthorized in 37ms (Views: 0.4ms | ActiveRecord: 18.8ms)

Completed 401 Unauthorized

哪个看起来更好，因为现在没有应用 CSRF 令牌检查，但我感觉我也access-token从gem devise_token_auth

问题：哪一种是禁用 CSRF 令牌检查的正确方法？注释掉protect_from_forgery或添加skip_before_action :verify_authenticity_token？

如果正确的方法是skip_before_action :verify_authenticity_token，如果我通过了，为什么我没有通过身份验证access-token？

这就是我打电话的方式：

const rawResponse = await fetch('https://plankorailsfour.herokuapp.com/api/v1/import', {
    method: 'POST',
    headers: {
      'Accept': 'application/json',
      'Content-Type': 'application/json',
      'Access-Token': auth.accessToken,
      'token-type': 'Bearer',
      'client': auth.client,
      'uid': '1',
      'X-Requested-With': 'XMLHttpRequest'
    },
    body: JSON.stringify(bodyRequest)
  })

我收到access-token登录请求的响应

4

1 回答 1

0

发现错误，当您从 rails 收到响应时，您会得到一个uid参数，它不是我想的整数，而是电子邮件...

于 2019-07-23T08:22:36.343 回答