401 未经设计基本授权

Question

我安装了 Rails 7.2.1，安装了 Devise basic。我在我的应用程序控制器中设置：

  def after_sign_in_path_for(current_user)
    # Assuming 'Dashboard' is a model and you have a show action
    dashboard_path(current_user)
  end

  def after_sign_up_path_for(current_user)
    # Assuming 'Dashboard' is a model and you have a show action
    dashboard_path(current_user)
  end 

信用是有效的，没有错误，但我尝试的所有操作都会导致我不断收到 401 未经授权的错误，我不知道为什么：

App 8384 output: I, [2024-09-20T22:12:03.793655 #8384]  INFO -- : [58b545d7-4177-4864-8459-3ddd062477a7] Started POST "/users/sign_in" for 173.171.196.191 at 2024-09-20 22:12:03 +0000
App 8384 output: I, [2024-09-20T22:12:03.794580 #8384]  INFO -- : [58b545d7-4177-4864-8459-3ddd062477a7] Processing by Users::SessionsController#create as TURBO_STREAM
App 8384 output: I, [2024-09-20T22:12:03.794622 #8384]  INFO -- : [58b545d7-4177-4864-8459-3ddd062477a7]   Parameters: {"email"=>"[email protected]", "password"=>"[FILTERED]", "remember_me"=>"0", "commit"=>"Log in"}
App 8384 output: I, [2024-09-20T22:12:03.795139 #8384]  INFO -- : [58b545d7-4177-4864-8459-3ddd062477a7] CSRF Protection Enabled? false
App 8384 output: I, [2024-09-20T22:12:03.795444 #8384]  INFO -- : [58b545d7-4177-4864-8459-3ddd062477a7] Completed 401 Unauthorized in 1ms (ActiveRecord: 0.0ms (0 queries, 0 cached) | GC: 0.0ms)
App 8384 output: I, [2024-09-20T22:12:03.796212 #8384]  INFO -- : [58b545d7-4177-4864-8459-3ddd062477a7] Processing by Users::SessionsController#new as TURBO_STREAM
App 8384 output: I, [2024-09-20T22:12:03.796252 #8384]  INFO -- : [58b545d7-4177-4864-8459-3ddd062477a7]   Parameters: {"email"=>"[email protected]", "password"=>"[FILTERED]", "remember_me"=>"0", "commit"=>"Log in"}
App 8384 output: I, [2024-09-20T22:12:03.796357 #8384]  INFO -- : [58b545d7-4177-4864-8459-3ddd062477a7] CSRF Protection Enabled? false
App 8384 output: I, [2024-09-20T22:12:03.798636 #8384]  INFO -- : [58b545d7-4177-4864-8459-3ddd062477a7]   Rendered layout layouts/application.html.erb (Duration: 1.5ms | GC: 0.1ms)
App 8384 output: I, [2024-09-20T22:12:03.798781 #8384]  INFO -- : [58b545d7-4177-4864-8459-3ddd062477a7] Completed 200 OK in 2ms (Views: 1.9ms | ActiveRecord: 0.0ms (0 queries, 0 cached) | GC: 0.1ms)

Answer 1

您的日志显示 CSRF 保护已启用？假

Rails 使用 CSRF 令牌来防止未经授权的操作，并且当禁用 CSRF 保护时，服务器可能会阻止登录尝试，这可能就是您收到 401 的原因。

我会确保启用 CSRF 保护：

class ApplicationController < ActionController::Base
 protect_from_forgery with: :exception
end

一个很好的参考可能是https://codeql.github.com/codeql-query-help/ruby/rb-csrf-protection-not-enabled/