{"action":"created","issue":{"url":"https://api.github.com/repos/rails/rails/issues/22807","repository_url":"https://api.github.com/repos/rails/rails","labels_url":"https://api.github.com/repos/rails/rails/issues/22807/labels{/name}","comments_url":"https://api.github.com/repos/rails/rails/issues/22807/comments","events_url":"https://api.github.com/repos/rails/rails/issues/22807/events","html_url":"https://github.com/rails/rails/issues/22807","id":123990663,"number":22807,"title":"Missing Authenticity Token in Remote Forms w/ File Upload Field(s)","user":{"login":"mvastola","id":599767,"avatar_url":"https://avatars.githubusercontent.com/u/599767?v=3","gravatar_id":"","url":"https://api.github.com/users/mvastola","html_url":"https://github.com/mvastola","followers_url":"https://api.github.com/users/mvastola/followers","following_url":"https://api.github.com/users/mvastola/following{/other_user}","gists_url":"https://api.github.com/users/mvastola/gists{/gist_id}","starred_url":"https://api.github.com/users/mvastola/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mvastola/subscriptions","organizations_url":"https://api.github.com/users/mvastola/orgs","repos_url":"https://api.github.com/users/mvastola/repos","events_url":"https://api.github.com/users/mvastola/events{/privacy}","received_events_url":"https://api.github.com/users/mvastola/received_events","type":"User","site_admin":false},"labels":[{"id":3666649,"url":"https://api.github.com/repos/rails/rails/labels/actionview","name":"actionview","color":"d7e102","default":false},{"id":128692,"url":"https://api.github.com/repos/rails/rails/labels/needs%20feedback","name":"needs feedback","color":"ededed","default":false},{"id":12449438,"url":"https://api.github.com/repos/rails/rails/labels/stale","name":"stale","color":"444444","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2015-12-27T18:09:59Z","updated_at":"2016-11-04T21:14:37Z","closed_at":null,"body":"**This is more-or-less a cross-post of https://github.com/rails/jquery-ujs/issues/451.**\n\nThis issue deals with `form_for` tags containing one or more `file_field`s where `:remote => true`.\n\n`config.action_view.embed_authenticity_token_in_remote_forms` defaults to `false` to facilitate fragment caching (which makes total sense), but the `jquery-ujs` gem is currently coded to permit (without alteration -- meaning it will submit as non-ajax) the submit event of any form if:\n- the `data-remote` attribute in `<form>` tag is set to `true`; and,\n- the `<form>` tag contains one or more `<input type=\"file\" />` children; and,\n- any `<input type=\"file\" />` tag has a file selected for upload\n\n_(Note that, by design, `jquery-ujs` does not provide a method to submit file uploads via AJAX. It only provides a non-AJAX fallback. To submit a remote form with file uploads via AJAX, one must include javascript that catches the submit action before `jquery-ujs` does.)_\n\nLong story short, there is an issue in that `jquery-ujs` cannot currently fulfill its role to provide a non-AJAX fallback since there is no hidden input element in the `<form>` provided by `actionview` (and `jquery-ujs` is not using the page's meta tags as it does for remote requests) containing an authenticity token, so none is `POST`ed an `InvalidAuthenticityToken` is raised in response to the form submission.\n\nThe question _du jour_ is where this bug should be fixed: should a hidden input element **always** be inserted by `actionview` in remote `form_for`s in which a `file_field` is present (regardless of `config.action_view.embed_authenticity_token_in_remote_forms`)? (This is the solution [suggested](https://github.com/rails/jquery-ujs/issues/451#issuecomment-167275142) by the `jquery-ujs` owner.) Alternatively, should `jquery-ujs` create a hidden `authenticity_token` input tag inside the `<form>` dynamically (with the value from the page's meta tags) immediately before it is about to fulfill its fallback role (my inclination).\n\nPlease advise/discuss/etc. (I'm happy to contribute a PR resolving the issue in whatever manner is mutually agreeable, but obviously either `rails` or `jquery-ujs` must be willing to merge it.)\n"},"comment":{"url":"https://api.github.com/repos/rails/rails/issues/comments/258549194","html_url":"https://github.com/rails/rails/issues/22807#issuecomment-258549194","issue_url":"https://api.github.com/repos/rails/rails/issues/22807","id":258549194,"user":{"login":"aguynamedben","id":107841,"avatar_url":"https://avatars.githubusercontent.com/u/107841?v=3","gravatar_id":"","url":"https://api.github.com/users/aguynamedben","html_url":"https://github.com/aguynamedben","followers_url":"https://api.github.com/users/aguynamedben/followers","following_url":"https://api.github.com/users/aguynamedben/following{/other_user}","gists_url":"https://api.github.com/users/aguynamedben/gists{/gist_id}","starred_url":"https://api.github.com/users/aguynamedben/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aguynamedben/subscriptions","organizations_url":"https://api.github.com/users/aguynamedben/orgs","repos_url":"https://api.github.com/users/aguynamedben/repos","events_url":"https://api.github.com/users/aguynamedben/events{/privacy}","received_events_url":"https://api.github.com/users/aguynamedben/received_events","type":"User","site_admin":false},"created_at":"2016-11-04T21:14:37Z","updated_at":"2016-11-04T21:14:37Z","body":"Wow, I've been tracking this down for hours, and it was painful. It's exactly as @mvastola describes it—CSRF fails when a form (1) has file inputs and (2) has remote: true.\r\n\r\nMy instinct is that this should be fixed in jquery-ujs. I documented my opinion on a fix here: https://github.com/rails/jquery-ujs/issues/451#issuecomment-258547646\r\n\r\nAn easy workaround is to add `authenticity_token: true` to your `form_for`:\r\n```erb\r\n<%= form_for @user, remote: true, authenticity_token: true do |f| %>\r\n  <%= f.file_field :image %>\r\n<% end %>\r\n```\r\n\r\nThat workaround is easy if you're not fragment caching forms, and ignores the documentation's statement that you should only use the `:authenticity_token` to customize or hide the field:\r\n> Use only if you need to pass custom authenticity token string, or to not add authenticity_token field at all (by passing false).\r\n\r\nPerhaps another way to \"fix\" this is to *always* include the authenticity token, and to instruct users who care about fragment caching to use `authenticity_token: false` on `form_for`. They're already having to perform nuanced coding around where to place cache statements, it seems reasonable that they should also have to remove CSRF tokens before caching."}}
{"actor":{"display_login":"aguynamedben"}}