Getting CSRF Error with Firefox and Devise

Question

For some reason my application won't login on firefox. It throws a CSRF error, although all tags are present and submitting successfully. Login also works on any other browser.

I found an answer that referenced changing:

Learn::Application.config.session_store :cookie_store, key: '_learn_session', domain: :all

to

Learn::Application.config.session_store :cookie_store, key: '_learn_session'

in config/initializers/session_store.rb

I've tried with both (and initially had it without domain: :all) but neither seem to work.

This question references my issue, but the answer is was not helpful in my situation.

To further complicate the situation, I've tested without CSRF enabled, and the app simply prevents a login without a failure notification.

Any help would be appreciated.

Answer 1

Have you ever checked your cookie?

I encountered the same problem earlier today and it turned out to be a problem with my cookie configuration. As your application still won't work without CSRF enabled, I think either your login_controller or session_store has bugs. Read session_store.rb and your_environment.rb carefully and maybe you can find what's wrong.

Answer 2

Wow. I managed to do this again (see comment on Tim's answer), so I'm really writing this answer to my future self. Specifically, Firefox had blocked cookies from localhost.

If I unblocked the cookies, after a while Firefox automatically blocks them again, requiring them to be unblocked. I'm not yet clear on why this happens, but at least the work around is obvious (Chrome).