从 Rails 2.3.4 升级到 2.3.14，现在测试失败（令人震惊，我知道）
问题似乎出在所有执行 POST、PUT、DELETE 请求的测试上。这些请求似乎没有附加 csrf 令牌。因此我被重定向到/login。当然，对于 GET 请求来说，这完全没问题。
值得一提的是，实际的浏览器交互效果很好。所以它在开发环境中有效，但在测试环境中无效。
还有其他人看过这个吗？
The problem seems to be with all tests that do POST, PUT, DELETE requests. It seems that csrf token is not being attached with those requests. Thus I get redirected to /login. It's perfectly fine with GET requests of course.
It's worth to mention that actual browser interactions are fine. So it works in dev, but not in test environment.
Anybody else seen this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这可能是由于 csrf 安全漏洞已修复。如果您尚未添加 csrf_meta_tags 并更新您的 jquery-ujs 文件，您可能还需要执行此操作才能进行升级。但如果它在开发模式下工作，情况可能并非如此。这是关于该主题的更详细的博客文章。 http://jasoncodes.com/posts/rails-csrf-vulnerability
It may be due to the csrf security vulnerabilities that were fixed. If you haven't already added csrf_meta_tags and updated your jquery-ujs file you may need to do that as well for the upgrade. This may not be the case if it works in development mode though. Heres a more detailed blog post about the subject. http://jasoncodes.com/posts/rails-csrf-vulnerability
好的，问题出在
protect_from_forgery上。由于某些我未知的原因before_filter :login_required触发得太早。我不知道具体细节或如何“正确”解决此问题。但这样做可以让我最终运行我的测试：Ok, So the issue was with
protect_from_forgery. For some unknown to me reasonbefore_filter :login_requiredwas triggering too early. I don't know the specifics or how to 'properly' fix this. But doing this allows me to run my test finally: