title: Dropbox SDK has missing CSRF token on production
body: <p>Using the official Ruby Dropbox SDK (<a href="https://www.dropbox.com/developers/core/sdks/ruby" rel="nofollow">https://www.dropbox.com/developers/core/sdks/ruby</a>), I have a problem that only occurs on production.</p>
  
  <p>I use the following code in my Rails 4.1.8 application to generate an authorization url to connect with Dropbox:</p>
  
  <pre><code>def dropbox_web_auth()
    DropboxOAuth2Flow.new ENV['DROPBOX_API_KEY'], ENV['DROPBOX_API_SECRET'],
      authorize_account_dropbox_index_url, session, :dropbox_auth_csrf_token
  end
  </code></pre>
  
  <p>This works. Both on development and production it generates an authorization URL which makes it possible to connect with Dropbox. But after I get redirected to my app I'm getting a <code>DropboxOAuth2Flow::BadStateError</code> error: <code>Missing CSRF token in session.</code></p>
  
  <p>I run a production server behind Cloudflare with Cloudflare's SSL enabled. I first suspected this would be a caching thing because my Evernote Oauth connection also fails (which doesn't give an error whatsoever), but purging the Cloudflare cache and putting the website in Development Mode wouldn't help.</p>
  
  <p>I suspect the error could have something to do with using ReactJS/Ajax. I'm doing an Ajax call from a React Component to a method that checks if the user has authorization. If not, it generates the authorization url:</p>
  
  <pre><code>if current_user.customer.dropbox_access_token
    begin
      dropbox_client().account_info
    rescue
      @authorization_url = dropbox_web_auth().start()
    end
  else
    @authorization_url = dropbox_web_auth().start()
  end
  </code></pre>
  
  <p><code>@authorization_url</code> gets passed back to the React Component which renders the URL. Because this call is handled by an Ajax call, the Ajax call sets the session with CSRF token but the user on the page doesn't yet have access to the just set CSRF token – only on a hard page refresh (but then the Ajax call would generate a new CSRF token which renders the previous useless).</p>
  
  <p>PS: I'm using an Ajax call because this way I can do an Ajax call per API which doesn't bottlenecks my app by having to wait for all API authorization checks to finish.</p>