title: Rails 3.2.6 session[:_csrf_token] different from meta tag
body: <p>I have a Rails application that I've upgraded from 3.0.7 to 3.2.6. I use Dalli and memcached for my session store.</p>
  
  <p>Since I've upgraded, I've started getting <code>WARNING: Can't verify CSRF token authenticity</code> errors, and my sessions are being reset.</p>
  
  <p>I call <code>csrf_meta_tags</code> in my header.</p>
  
  <p>In my ApplicationController, I've overridden <code>verify_authenticity_token</code> in order to check out what the app thinks the csrf_token is.</p>
  
  <pre><code>def verify_authenticity_token
    verified_request?
    Rails.logger.info "+++ VERIFY AUTH TOKEN +++"
    Rails.logger.info session.inspect
  end
  </code></pre>
  
  <p>I submitted a form from my app, and the session data written to the logger was:
  <code>{"_csrf_token"=&gt;"4OQ47F2py+l12lLSTnq0RTmyPbmPi2UGMZaPhMG6vVQ="}</code></p>
  
  <p>This differs from the value set on the page in the meta tag and from the value submitted with the form:
  <code>{"authenticity_token"=&gt;"qMsdBkTHoBH09+X0tnyoPsbtc752yKjCVHddrcufd7g="}</code></p>
  
  <hr>
  
  <h2>PROBLEM SOLVED</h2>
  
  <p>It turns out this was due to a configuration error.</p>
  
  <p>I had been setting the <code>session_store</code> config in config/initializers/session_store.rb:</p>
  
  <pre><code>require 'action_dispatch/middleware/session/dalli_store'
  Rails.application.config.session_store :dalli_store
  </code></pre>
  
  <p>This was initialized for all environments, however in the development environment, the default config for caching is <code>config.perform_caching = false</code>.</p>
  
  <p>Deleting the initializer file and moving the session store config to the production.rb file fixed the issue for me.</p>
  
  <pre><code>config.session_store = :dalli_store, 'localhost:11211'
  </code></pre>
  
  <p>I'm just not sure why this wasn't an issue in 3.0.2, but is in 3.2.6.</p>