Can't verify CSRF token authenticity

Hi,

Started POST "/datatables/users_datatable-633246437562.json" for 79.75.59.52 at 2018-01-26 17:05:24 +0000
Processing by Effective::DatatablesController#show as JSON
  Parameters: {"draw"=>"2", "columns"=>{"0"=>{"data"=>"0", "name"=>"email", "searchable"=>"true", "orderable"=>"true", "search"=>{"value"=>"gm", "regex"=>"false"}, "vis
ible"=>"true"}, "1"=>{"data"=>"1", "name"=>"name", "searchable"=>"true", "orderable"=>"true", "search"=>{"value"=>"", "regex"=>"false"}, "visible"=>"true"}, "2"=>{"data
"=>"2", "name"=>"eth_address", "searchable"=>"true", "orderable"=>"true", "search"=>{"value"=>"", "regex"=>"false"}, "visible"=>"true"}, "3"=>{"data"=>"3", "name"=>"kyc
", "searchable"=>"true", "orderable"=>"true", "search"=>{"value"=>"", "regex"=>"false"}, "visible"=>"true"}, "4"=>{"data"=>"4", "name"=>"whitelisted", "searchable"=>"tr
ue", "orderable"=>"true", "search"=>{"value"=>"", "regex"=>"false"}, "visible"=>"true"}, "5"=>{"data"=>"5", "name"=>"GCP", "searchable"=>"true", "orderable"=>"true", "s
earch"=>{"value"=>"", "regex"=>"false"}, "visible"=>"true"}}, "order"=>{"0"=>{"column"=>"0", "dir"=>"asc"}}, "start"=>"0", "length"=>"25", "search"=>{"value"=>"", "rege
x"=>"false"}, "cookie"=>"633246437562", "id"=>"users_datatable-633246437562"}
Can't verify CSRF token authenticity.
Completed 401 Unauthorized in 1ms (ActiveRecord: 0.0ms)

ActionController::InvalidAuthenticityToken (ActionController::InvalidAuthenticityToken):

I use Devise. If current_user is admin (when admin attribute is true), I want to authorize the display of the Users datatables.

Within config/initializers/effective_datatables.rb for auth:

config.authorization_method = Proc.new { |controller, action, resource| current_user.admin? }

Within app/datatables/users_datatable.rb:

class UsersDatatable < Effective::Datatable
  datatable do
    col :email
    col :name
    col :eth_address
    col :kyc
    col :whitelisted
    col :GCP
  end

  collection do
    User.all
  end
end

Within application.js:

cat application.js
// This is a manifest file that'll be compiled into application.js, which will include all the files
// listed below.
//
// Any JavaScript/Coffee file within this directory, lib/assets/javascripts, vendor/assets/javascripts,
// or vendor/assets/javascripts of plugins, if any, can be referenced here using a relative path.
//
// It's not advisable to add code directly here, but if you do, it'll appear at the bottom of the
// compiled file.
//
// Read Sprockets README (https://github.com/sstephenson/sprockets#sprockets-directives) for details
// about supported directives.
//
//= require jquery
//= require jquery_ujs
//= require turbolinks
//= require bootstrap-sprockets
//= require_tree .
//= require effective_datatables

Within application.css.scss:

 /*
 * This is a manifest file that'll be compiled into application.css, which will include all the files
 * listed below.
 *
 * Any CSS and SCSS file within this directory, lib/assets/stylesheets, vendor/assets/stylesheets,
 * or vendor/assets/stylesheets of plugins, if any, can be referenced here using a relative path.
 *
 * You're free to add application-wide styles to this file and they'll appear at the bottom of the
 * compiled file so the styles you add here take precedence over styles defined in any styles
 * defined in the other CSS/SCSS files in this directory. It is generally better to create a new
 * file per style scope.
 *
 *= require_tree .
 *= require_self
 *= require effective_datatables
 */

Any idea? @matt-riemer

Thanks!

[HLFH]

Related to: https://github.com/rails/rails/issues/22965, Rails 5 & Puma & Nginx… These config lines were missing:

  proxy_set_header  X-Forwarded-Proto $scheme;
  proxy_set_header  X-Forwarded-Ssl on;
  proxy_set_header  X-Forwarded-Port $server_port;
  proxy_set_header  X-Forwarded-Host $host;

Request origin did not match request base_url that was showing http instead of https.

[matt-riemer]

Thanks for coming back and posting this!

Could save someone a ton of time one day.

Cheers 😃