13

For some reason, current_user returns nil in my model-less controller (Subscriptions). I have found nothing on the Internet to justify this behavior...

class SubscriptionsController < ApplicationController  
  def new
    ...
  end

  def create
    current_user    # returns nil
  end
end

I have a csrf meta tag :

<meta content="xxx" name="csrf-token">

I can provide more code, but I'm not sure what would be useful.

UPDATE

So thanks to the comments/answers, I have pinpointed the problem to one particular action : create.

if I add @user = current_user to the new, I can show the current user's email in my new view. However, in my create controller, current_user returns nil.

I accessed the create action through a form (submit).

Before the form is submitted, I validate the input and then send a request to Stripe to get a token out of the form. If there are no errors (validation and stripe), I then send the form.

Could that be the cause?

UPDATE 2

In my error message, my session dump is empty, while it should contains the current_user info...

2
  • 1
    Is your model for users named User? because current_*** will take the name of the model. What does user_signed_in? return?
    – rorlork
    Aug 24, 2013 at 22:27
  • It is set to false... That's weird because the user must be authenticated to see the page
    – Justin D.
    Aug 24, 2013 at 22:30

4 Answers 4

13

It turned out the AJAX request I was making didn't carry the CSRF token. For that reason, Rails was killing my session.

I added skip_before_filter :verify_authenticity_token in my SubscriptionsController and it is now working. It might not be the most secure solution, but it works for now, so I continue to develop and come back to this issue later.

2
  • 2
    Why wasn't it carrying the token? I think I might have the same issue sometimes.
    – am-rails
    Dec 23, 2013 at 18:51
  • @am-rails, It's been few months and I don't remember exactly. It was definitely caused by my AJAX call though...
    – Justin D.
    Dec 24, 2013 at 3:48
6

Note that when you create forms using the form_tag helper, they do not automatically generate the hidden field which holds the token for CSRF authentication. I ran into this same issue with a form I had constructed using the form_tag which I sometimes prefer using.

I fixed the issue by including the following helpers within the form:

<%= hidden_field_tag 'authenticity_token', form_authenticity_token %>

It's basically a manual way of generating the hidden field you need for the CSRF stuff.

3

for current_user to work you need to add before_filter :authenticate_user! to your class, like:

class SubscriptionsController < ApplicationController  
  before_filter :authenticate_user!

  def new
    ...
  end

  def create
    curent_user    # returns nil
  end
end

and the authenticate_user! method will set the current user for you :)

5
  • I tried that before. It redirects the user to the login page, as if it was not logged in. I'll edit my question with more info on that in a minute.
    – Justin D.
    Aug 24, 2013 at 22:32
  • 4
    Well, yes, :authenticate_user! what it does is check for user_signed_in? and if it's false, send the user to the sign-in page. It's not needed for current_user to be initialized.
    – rorlork
    Aug 24, 2013 at 22:33
  • The thing is, the user is supposed to be authenticated because he accessed the page. So, while authenticate_user! shows the problem, it does not directly solves it. Very useful to pinpoint the error, though.
    – Justin D.
    Aug 24, 2013 at 22:35
  • 1
    Debug your issue: First, be sure you run exactly "create" action.. Second, just check out if your session is stable on any action: place somewhere in a view <%= request.session_options[:id] %>. It wouldn't change. So, if 1 and 2 passed, thus the problem is in app logic... Aug 24, 2013 at 23:55
  • 6
    all before_filters are deprecated in Rails 5.0 and will be removed in Rails 5.1. Use before_action instead
    – Martin
    Apr 6, 2016 at 9:52
1

I had a similar issue but I was editing the model. So everytime I updated the model suddenly that would happen:

current_model to nil

After analyzing things, it turns out that if you leave the password in the form, when the user tries to edit some attribute, the person is then forced to write a password.
Once the form is delivered and updated, Devise does the rational thing when someone updates a password, which is to destroy the session and ask the user to sign in again.

So that was why current_model was suddenly turning to nil. Hope this helps, have a great day!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.