{"action":"opened","issue":{"url":"https://api.github.com/repos/hassox/warden/issues/132","repository_url":"https://api.github.com/repos/hassox/warden","labels_url":"https://api.github.com/repos/hassox/warden/issues/132/labels{/name}","comments_url":"https://api.github.com/repos/hassox/warden/issues/132/comments","events_url":"https://api.github.com/repos/hassox/warden/issues/132/events","html_url":"https://github.com/hassox/warden/issues/132","id":150527441,"number":132,"title":"User session lost after post request","user":{"login":"stephan-nordnes-eriksen","id":2276383,"avatar_url":"https://avatars.githubusercontent.com/u/2276383?v=3","gravatar_id":"","url":"https://api.github.com/users/stephan-nordnes-eriksen","html_url":"https://github.com/stephan-nordnes-eriksen","followers_url":"https://api.github.com/users/stephan-nordnes-eriksen/followers","following_url":"https://api.github.com/users/stephan-nordnes-eriksen/following{/other_user}","gists_url":"https://api.github.com/users/stephan-nordnes-eriksen/gists{/gist_id}","starred_url":"https://api.github.com/users/stephan-nordnes-eriksen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stephan-nordnes-eriksen/subscriptions","organizations_url":"https://api.github.com/users/stephan-nordnes-eriksen/orgs","repos_url":"https://api.github.com/users/stephan-nordnes-eriksen/repos","events_url":"https://api.github.com/users/stephan-nordnes-eriksen/events{/privacy}","received_events_url":"https://api.github.com/users/stephan-nordnes-eriksen/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-04-23T07:27:35Z","updated_at":"2016-04-23T07:27:35Z","closed_at":null,"body":"It appears that my `env['warden'].user` is lost if my app receives a post request. \r\n\r\nThis is the test methods I am using:\r\n\r\n```\r\nget '/amiloggedin' do\r\n\tputs \"get user\"\r\n  \tputs env['warden'].user.inspect\r\n  \tputs env['HTTP_COOKIE'] \r\n  \tenv['warden'].authenticate!\r\n\r\n  \t\"You are logged in\"\r\n  end\r\n\r\n  post '/amiloggedin' do \r\n  \tputs \"post user\"\r\n  \tputs env['warden'].user.inspect\r\n  \tputs env['HTTP_COOKIE']\r\n  \tenv['warden'].authenticate!\r\n  \t\r\n  \t\"Logged in after post request\"\r\n  end\r\n```\r\n\r\nThe `HTTP_COOKIE` is the same for both requests, but for some reason the warden user is lost when I send a post request. It is lost for that request and further all requests (including get requests).\r\n\r\nThis is my a strategy:\r\n\r\n```\r\n\r\nWarden::Strategies.add(:password) do\r\n  def valid?\r\n    params['user'] && params['user']['email'] && params['user']['password']\r\n  end\r\n\r\n  def authenticate!\r\n    user = User.first(email: params['user']['email'])\r\n\r\n    if user.nil?\r\n      throw(:warden, message: \"The email you entered does not exist.\")\r\n    elsif user.authenticate(params['user']['password'])\r\n      success!(user)\r\n    else\r\n      throw(:warden, message: \"The email and password combination \")\r\n    end\r\n  end\r\nend\r\n\r\n\r\n```\r\n\r\nThis is my user model:\r\n```\r\nDataMapper.setup(:default, \"sqlite://#{Dir.pwd}/db/db.sqlite\")\r\n\r\nclass User\r\n  include DataMapper::Resource\r\n\r\n  property :id, Serial, key: true\r\n  property :username, String, length: 128\r\n\r\n  #property :password, BCryptHash, :required => true, :length => 5..200\r\n  property :password, BCryptHash, :required => true\r\n\r\n  attr_accessor :password_confirmation\r\n  validates_confirmation_of :password, :confirm => :password_confirmation\r\n  validates_length_of :password_confirmation, :min => 6\r\n  \r\n  property :email, String, :required => true, :unique => true,\r\n    :format   => :email_address,\r\n    :messages => {\r\n      :presence  => \"We need your email address.\",\r\n      :is_unique => \"We already have that email.\",\r\n      :format    => \"Doesn't look like an email address to me ...\"\r\n    }\r\n\r\n  def authenticate(attempted_password)\r\n    # The BCrypt class, which `self.password` is an instance of, has `==` defined to compare a\r\n    # test plain text string to the encrypted string and converts `attempted_password` to a BCrypt\r\n    # for the comparison.\r\n    #\r\n    # But don't take my word for it, check out the source: https://github.com/codahale/bcrypt-ruby/blob/master/lib/bcrypt/password.rb#L64-L67\r\n    if self.password == attempted_password\r\n      true\r\n    else\r\n      false\r\n    end\r\n  end\r\nend\r\n\r\n# Tell DataMapper the models are done being defined\r\nDataMapper.finalize\r\n\r\n# Update the database to match the properties of User.\r\nDataMapper.auto_upgrade!\r\n\r\n# Create a test User\r\nif User.count == 0\r\n  @user = User.create(username: \"admin\")\r\n  @user.password = \"admin\"\r\n  @user.save\r\nend\r\n```\r\n\r\nIs there something wrong with my strategy?"}}