Omniauth + Facebook失去了会话

Question

在最近的一个项目中,facebook User可以使用他们的Facebook UID登录,根据文件上传或从他们的个人专辑上传等内容上传图片.

在development环境中我的本地系统上的一切都很好用.通过Facebook登录,退出,上传 - 一切都很棒.

在production虽然我面临着未知和难以调试的问题.似乎每隔一段时间(实际上可以在将新内容上传Submission到系统时可重现)会话丢失,图片不会上传并且facebook用户已注销(!).

我正在使用设计和omniauth.Omniauth已集成到Devise中.

以下是触及Devise/Omniauth或者的所有代码User.

应用程序/模型/ user.rb

class User < ActiveRecord::Base
  devise :omniauthable, :rememberable, :omniauth_providers => [:facebook]

  def self.create_with_omniauth(auth)
    u = User.find_by_uid(auth["uid"])
    return u unless u.nil?

    create! do |user|
      user.provider = auth["provider"]
      user.uid = auth["uid"]
      user.name = auth["user_info"]["name"]
      user.email = auth['user_info']['email']
    end
  end

  def after_signin_path
    '/competition'
  end
end

:rememberable我希望数据库包含所有需要的字段.

应用程序/控制器/用户/ omniauth_callbacks_controller.rb

class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
  def facebook
    # You need to implement the method below in your model
    @user = User.create_with_omniauth(env["omniauth.auth"])

    if @user.persisted?
      flash[:notice] = I18n.t "devise.omniauth_callbacks.success", :kind => "Facebook"
      @user.update_attributes!(:current_auth_token => env["omniauth.auth"]['credentials']['token'], :last_language => I18n.locale.to_s, :updated_at => Time.now, :remember_created_at => Time.now)

      sign_in_and_redirect(:user, @user)    
    else
      redirect_to '/competition'
    end
  end

protected
  def after_omniauth_failure_path_for resource
    '/competition'
  end
end

配置/初始化/ devise.rb

OmniAuth.config.full_host = "http://#{APP_CONFIG[:domain]}"

Devise.setup do |config|
  config.mailer_sender = "devise@myapp.host.com"

  require 'devise/orm/active_record'

  config.stretches = 10

  config.encryptor = :bcrypt
  config.timeout_in = 3.days

  config.pepper = "2a4b8b2ed9e12e553a7a542176f2ace1af62c062f3ba203a590b8b6307f33042b394922807a840004a3dcdf1c4e97ae085fe2c29654ddaeab7c60f431a8078abb"

  config.omniauth :facebook, APP_CONFIG[:facebook_app_id], APP_CONFIG[:facebook_app_secret], {
    :scope => "email,user_photos,user_photos,publish_stream,offline_access",
    :client_options => {
      :ssl => {
        :ca_file => "/etc/pki/tls/certs/ca-bundle.crt"
      }
    }
  }
end

application_controller.rb中没有与auth相关的方法.

routes.rb:

有趣的部分如下:

  devise_for :users, :controllers => { :omniauth_callbacks => "users/omniauth_callbacks" }

  match '/logout_fb' => 'start#logoutfb'

  authenticate :user do
    get '/users/connect/:network', :to => redirect("/users/auth/%{network}")
  end

不知何故,我无法理解验证块,根据另一篇文章应该是有帮助的..这个想法呢？

这么多理论:一个是用户会话中的facebook函数omniauth_callbacks_controller,因此sign_in_and_redirect不起作用.所以我有了重定向到另一个页面的想法,比如'/ auth？uid = xxx'但这听起来既错误,不安全又不稳定.

任何帮助或提示表示赞赏!

Answer 1

有点长镜头,但尝试关闭protect_from_forgery - 我遇到了一些会话消失的问题,结果证明是这里讨论的问题https://github.com/intridea/omniauth/issues/203