I'm using an exception notification plugin which sends me an email
whenever an exception is raised on the rails server. Regularly I'm
getting exception reports due to raising a PermissionDenied exception
when a user has no access or because rails complains about an invalid
authenticity token.
I can never reproduce these. And in 99% of the cases it works fine for
our users, but there's a 1% for whom it apparently fails.
These exceptions are always due to an action triggered by an ajax
request.
The content of the exception report is always something like below.
The thing I find odd is that the HTTP_COOKIE indicates the user is
logged in, but the session section reports a session_id of nil. I.e.,
the code will see the user as logged out, and raise an access denied
exception.
In my log I can see that subsequent (non-Ajax) requests from the same
user do work fine.
I also notice that all exception reports are always from MSIE6.0 and
MSIE7.0 clients.
I'm using jQuery.
I was wondering if anyone else has seen issues like this. Is there a
known cause and/or workaround / solution?
I'm using an exception notification plugin which sends me an email
whenever an exception is raised on the rails server. Regularly I'm
getting exception reports due to raising a PermissionDenied exception
when a user has no access or because rails complains about an invalid
authenticity token.
I can never reproduce these. And in 99% of the cases it works fine for
our users, but there's a 1% for whom it apparently fails.
These exceptions are always due to an action triggered by an ajax
request.
do you have a concurrent request problem ? when you get two
overlapping requests from a single user then changes by one of them to
the session will 'beat' changes by the other one.
I've seen these in production - but I've never been able to run down
the source. It's always IE that's causing them, though. I think there
may be some PC antivirus or "accelerator" that's trying to prefetch
stuff but doing it wrong...
This action is triggered by pressing a button which executes a piece
of javascript.. the setup is done in a jquery document ready block of
code. It would highly surprise me if a prefetcher would trigger that
button.
As the action is triggered by a user action, I also don't think this
should give a concurrent request problem. (the app runs in passenger
too, I was under the impression that within passenger you shouldn't
run into any concurrency issues anyways?)
The source is indeed always an MSIE browser, which would suggest a
browser issue. However, seeing that the browser does send a correct
cookie with the session id in there, I wonder if for some reason the
rails server can't match the session...