Rails - 会话无法通过AJAX登录？

Question

我有一个Rails应用程序,它使用静态html页面(不在app/views /中)向rails服务器发送AJAX请求以进行登录和注销.

我使用会话进行用户身份验证,当用户登录时,session[:userid]设置并将响应"登录"发送回静态html页面.但是当我点击退出按钮后登录后,我发现了session[:userid]变成了nil.

这是我的代码:

登录:

  def login
    # code here
    if encrypt(params[:password]) == @user.password # authenticated
      session[:userid] = @user.id
      render :text => 'logged in'
    else # wrong password
      render :text => 'password not correct'
    end
  end

退出

  def logout
    # here session is no longer available  
    session[:userid] = nil  
    render :text => 'logged out'
  end

登录页面:

    <button id='login_button'>Log in</button>
    <script type="text/javascript" charset="utf-8">
        $('#login_button').click(function() {
            $.ajax({
                type: 'POST',
                url: 'http://localhost:3000/user/login',
                data: { username : $('#login_username').val() , password : $('#login_password').val() }
            }).done(function(data) {
                if (data == 'logged in') {
                    window.location = 'logged_in.html';
                } else {
                    alert(data);
                }
            });
        });
    </script>

退出:

<button id='logout_button'>Log out</button>
<script type="text/javascript" charset="utf-8">
    $('#logout_button').click(function() {
        $.ajax({
            type: 'POST',
            url: 'http://localhost:3000/user/logout',
        }).done(function(data) {
            console.log(data);
        });
    });
</script>

登录登录:

Started POST "/user/login" for 127.0.0.1 at 2012-10-12 16:28:46 -0500
Processing by UserController#login as */*
  Parameters: {"username"=>"name", "password"=>"[FILTERED]"}
  User Load (0.1ms)  SELECT "users".* FROM "users" WHERE (username = 'name')
Completed 200 OK in 12ms (Views: 0.3ms | ActiveRecord: 0.6ms)

登录注销:

Started POST "/user/logout" for 127.0.0.1 at 2012-10-12 16:28:50 -0500
Processing by UserController#logout as */*
{} <--------------------------------------- here I printed out session
  Rendered text template (0.0ms)
Completed 200 OK in 1ms (Views: 0.7ms | ActiveRecord: 0.0ms)

这是AJAX的问题,我们不能使用session来获取客户端的AJAX请求吗？

提前致谢.

Answer 1

你有"protect_from_forgery"设置吗？如果是这样,这就导致了问题.当Rails收到Ajax调用但未找到正确的CSRF令牌时,它将关闭会话.

而不是全局关闭保护,最好通过在相关控制器中放置类似这样的内容来关闭静态页面的任何调用:

skip_before_filter :verify_authenticity_token, :only => [:login, :logout]