Skip to content

Conversation

@RobinDaugherty
Copy link
Member

@RobinDaugherty RobinDaugherty commented Sep 24, 2020

Fixes #476.

Since the initial Better Errors console can be opened on any path, the CSRF cookie might be set initially within a path. This would limit the visibility of the cookie, causing subsequent requests to internal Better Errors calls (which are are at /__better_errors) to fail because the cookie is not available in the request.

This fixes the issue by setting the CSRF Token cookie in the root path, which will make it available to all internal Better Errors requests as well as any console that will open as the result of an error thrown within the application.

In order to reduce any problems caused by CSRF tokens set with a limited path by an older version of Better Errors, the BE version is now also part of the CSRF Token cookie name. While the cookie would expire at the end of the browser session, this will eliminate the possibility that the developer will get a CSRF error after upgrading Better Errors, restarting their server, and then hitting Refresh in the browser (which is honestly a pretty likely scenario).

@RobinDaugherty RobinDaugherty merged commit eae8285 into master Sep 24, 2020
@RobinDaugherty RobinDaugherty deleted the fix/csrf-token-cookie-path branch September 24, 2020 14:10
RobinDaugherty added a commit that referenced this pull request Sep 24, 2020
@MrJoy
Copy link

MrJoy commented Sep 24, 2020

Awesome! Thank you so much!

@y-yagi
Copy link
Contributor

y-yagi commented Sep 29, 2020

@RobinDaugherty Do you have a plan to release 2.8.2? The lib/better_errors/version.rb already bumped with be7475b, but 2.8.2 doesn't exist in Rubygems https://rubygems.org/gems/better_errors/versions.

@RobinDaugherty
Copy link
Member Author

RobinDaugherty commented Oct 1, 2020

Very sorry @y-yagi somehow I messed that up. It should be available through rubygems now.

@y-yagi
Copy link
Contributor

y-yagi commented Oct 2, 2020

@RobinDaugherty Thank you!!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Invalid CSRF Token error in Better Errors console

4 participants