{"action":"created","issue":{"url":"https://api.github.com/repos/sinatra/rack-protection/issues/83","repository_url":"https://api.github.com/repos/sinatra/rack-protection","labels_url":"https://api.github.com/repos/sinatra/rack-protection/issues/83/labels{/name}","comments_url":"https://api.github.com/repos/sinatra/rack-protection/issues/83/comments","events_url":"https://api.github.com/repos/sinatra/rack-protection/issues/83/events","html_url":"https://github.com/sinatra/rack-protection/issues/83","id":35549136,"number":83,"title":"AuthenticityToken check in a rails app when no session['_csrf_token'] is set ","user":{"login":"anthony","id":10130,"avatar_url":"https://avatars.githubusercontent.com/u/10130?v=3","gravatar_id":"","url":"https://api.github.com/users/anthony","html_url":"https://github.com/anthony","followers_url":"https://api.github.com/users/anthony/followers","following_url":"https://api.github.com/users/anthony/following{/other_user}","gists_url":"https://api.github.com/users/anthony/gists{/gist_id}","starred_url":"https://api.github.com/users/anthony/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/anthony/subscriptions","organizations_url":"https://api.github.com/users/anthony/orgs","repos_url":"https://api.github.com/users/anthony/repos","events_url":"https://api.github.com/users/anthony/events{/privacy}","received_events_url":"https://api.github.com/users/anthony/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2014-06-12T04:20:31Z","updated_at":"2016-09-07T03:23:10Z","closed_at":"2016-08-01T08:56:16Z","body":"We have a rails application that is fronted by a 3rd party authentication server.\r\n\r\nUpon the first page load no `session['_csrf_token']` has been set. \r\n\r\nThis worked fine until we upgraded from 1.5.0 to .1.5.3 and this commit came in: https://github.com/rkh/rack-protection/commit/c415d50c7ce97d35c8fae706dbed3390330b983d\r\n\r\nThe issue here is that `session[:csrf]` is being assigned a `random_number` as the `session['_csrf_token']` is not set, but all requests after the first page load will have a `authenticity_token` set from rails so the comparison between that and what is in the session will always fail.\r\n\r\nI haven't provided a patch because I'm not sure how or if you'd like this addressed. For us we have just disabled the `RemoteToken` check as rails handles that anyway."},"comment":{"url":"https://api.github.com/repos/sinatra/rack-protection/issues/comments/245164051","html_url":"https://github.com/sinatra/rack-protection/issues/83#issuecomment-245164051","issue_url":"https://api.github.com/repos/sinatra/rack-protection/issues/83","id":245164051,"user":{"login":"zzak","id":277819,"avatar_url":"https://avatars.githubusercontent.com/u/277819?v=3","gravatar_id":"","url":"https://api.github.com/users/zzak","html_url":"https://github.com/zzak","followers_url":"https://api.github.com/users/zzak/followers","following_url":"https://api.github.com/users/zzak/following{/other_user}","gists_url":"https://api.github.com/users/zzak/gists{/gist_id}","starred_url":"https://api.github.com/users/zzak/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zzak/subscriptions","organizations_url":"https://api.github.com/users/zzak/orgs","repos_url":"https://api.github.com/users/zzak/repos","events_url":"https://api.github.com/users/zzak/events{/privacy}","received_events_url":"https://api.github.com/users/zzak/received_events","type":"User","site_admin":false},"created_at":"2016-09-07T03:23:10Z","updated_at":"2016-09-07T03:23:10Z","body":"Yes, so I think the original intention was to have them be compatible.. but I'm not sure who broke compat first.\r\n\r\nMy guess is that when Rails adopted the BREACH mitigation strategy tokens were no longer compatible.\r\n\r\nWe can either try to adopt their strategy more closely, or drop compatibility. I'm fine with both, probably the later is easier. My question then would be, how to share sessions between Rails and Sinatra? I think some people might be trying to do this, or need this feature."}}
{"actor":{"display_login":"zzak"}}