Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix path of CSRF Token cookie #478

Merged
merged 2 commits into from
Sep 24, 2020
Merged

Conversation

RobinDaugherty
Copy link
Member

@RobinDaugherty RobinDaugherty commented Sep 24, 2020

Fixes #476.

Since the initial Better Errors console can be opened on any path, the CSRF cookie might be set initially within a path. This would limit the visibility of the cookie, causing subsequent requests to internal Better Errors calls (which are are at /__better_errors) to fail because the cookie is not available in the request.

This fixes the issue by setting the CSRF Token cookie in the root path, which will make it available to all internal Better Errors requests as well as any console that will open as the result of an error thrown within the application.

In order to reduce any problems caused by CSRF tokens set with a limited path by an older version of Better Errors, the BE version is now also part of the CSRF Token cookie name. While the cookie would expire at the end of the browser session, this will eliminate the possibility that the developer will get a CSRF error after upgrading Better Errors, restarting their server, and then hitting Refresh in the browser (which is honestly a pretty likely scenario).

@RobinDaugherty RobinDaugherty merged commit eae8285 into master Sep 24, 2020
@RobinDaugherty RobinDaugherty deleted the fix/csrf-token-cookie-path branch September 24, 2020 14:10
RobinDaugherty added a commit that referenced this pull request Sep 24, 2020
@MrJoy
Copy link

MrJoy commented Sep 24, 2020

Awesome! Thank you so much!

@y-yagi
Copy link
Contributor

y-yagi commented Sep 29, 2020

@RobinDaugherty Do you have a plan to release 2.8.2? The lib/better_errors/version.rb already bumped with be7475b, but 2.8.2 doesn't exist in Rubygems https://rubygems.org/gems/better_errors/versions.

@RobinDaugherty
Copy link
Member Author

RobinDaugherty commented Oct 1, 2020

Very sorry @y-yagi somehow I messed that up. It should be available through rubygems now.

@y-yagi
Copy link
Contributor

y-yagi commented Oct 2, 2020

@RobinDaugherty Thank you!!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Invalid CSRF Token error in Better Errors console
3 participants