Rails 3、protect_from_forgery 和 IE8 问题
有一个Rails应用程序，在所有浏览器（Safari，Firefox，IE6、7、8等）中对我来说一切都很好
我 ，在他们甚至进入登录页面之前，它们会出现Windows身份验证提示。如果他们试图输入登录详细信息，则他们已经失败了。我并不是真的担心它失败了，因为身份验证提示不应该出现。
一旦我从Application Controller中删除Protect_From_Forgery，他们就可以罚款系统。
我已经尝试建议允许cookie等，但是他们仍然遇到问题。是否有人对其他事情有任何建议，
只是为此添加。该网站使用大本营风格的子域系统。不确定这是否是问题。
I have a rails app that all works fine for me in all browsers (Safari, Firefox, IE6, 7, 8 etc)
I have a new user who has a fairly locked down version of IE8 and as soon as they try to access the app, before they even get to the login page, they get a Windows Authentication prompt appear. If they try to enter the login details they have been provided it fails. I'm not really worried about it failing, as the authentication prompt shouldn't be appearing.
As soon as I remove protect_from_forgery from the ApplicationController they can access the system fine.
I've tried suggesting allowing cookies etc, but they are still getting the problem. Has anyone got any suggestions as to other things we could look
Just to add to this. The site uses a basecamp style subdomain system. Not certain if that's an issue or not.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您正在使用哪个版本的Rails？您正在使用哪个身份验证框架？
我对Rails 3.0.3和一些早期版本的行为也有相同的行为。我遇到的问题是，在某些情况下，IE8决定在HTTP标头中发送“接受类型： */ *”，而不是一系列支持的格式。 Rails/Dewance Shots的某个地方被滑倒，HTTP身份验证状态被寄回。
我通过升级到Rails 3.0.5并设计1.2.RC2来解决我的问题。
Which version of Rails are you using? Which authentication framework are you using?
I had the same behavior with Rails 3.0.3 and some earlier version of Devise. The issue I had was that in some circumstances IE8 decides to send 'Accept-Type: */*' in the HTTP header instead of a long line of supported formats. Somewhere within Rails/Devise something slipped and a HTTP authentication status was sent back.
I solved my problem by upgrading to Rails 3.0.5 and Devise 1.2.rc2.
如果其他人仍然遇到这个问题，我正在使用 Rails 3.0.9 和 Devise 1.2.1，但仍然遇到这个问题。我的问题是 IE 不会为带有下划线的子域设置 cookie。请参阅此答案了解细节。因此，我将子域更改为使用破折号，现在它可以工作了。
In case anyone else still has problems with this, I am using Rails 3.0.9 and Devise 1.2.1 and was still having this problem. My problem was that IE won't set cookies for subdomains with an underscore in them. See this answer for the details. So I changed my subdomains to use dashes and it works now.