Rails community,
I have been investigating and debugging a serious, widespread problems with our Rails 4.1 app (I realize Rails 4.1 is no longer supported, see below.)
**This is not a simple “pass the CSFR token from the form to the controller” question. **
This appears to me to be a serious, widespread architectural flaw in Rails 4.0 and Rails 4.1 that appear to basically make those versions of Rails essentially incompatible with newer browsers. (The newer browsers, by the way, appear not to be respecting Cache-control headers, which looks to me the like the root of the problem)
The problem is detailed here:
Quick question:
As explained here, I understand that the CSRF implementation to be different in Rails 5. Specifically, each form gets its own token. My question is this: Does this new design in Rails 5 eliminate or lessen the symptom described in my SO post above?
If so, this would be a compelling reason for us to upgrade to Rails 5, as we think we are loosing a significant amount of traffic due to this bug.
If not, I am wondering if others are seeing this too and what can be done to address this issue.
-Jason
