Any post requests to /webhooks/mailgun
are returned an HTTP 422, and the server logs show an ActionController::InvalidAuthenticityToken
error. This was tested on a new installation with no plugins.
This first started around the middle of May looking at logs from my main forum.
pfaffman
(Jay Pfaffman)
30 Mayo, 2022 11:56
2
Are you sure that the API key is valid?
Yeah I’ve checked the key and it’s definitely valid.
I don’t really think it has anything to do over whether they key is valid or not (unless an invalid key causes a csrf error for some reason)
znedw
(Zach Nedwich)
10 Junio, 2022 00:55
6
david
(David Taylor)
13 Junio, 2022 14:38
8
Thanks for the PR @Wolftallemo - I just merged it and added some extra info in the commit message:
committed 02:36PM - 13 Jun 22 UTC
The `WebhookController` inherits directly from `ActionController::Base`. Since R… ails 5.2, forgery protection has been enabled by default. When we applied those new defaults in 0403a8633bdedfe497ec3e2fe5d03e17940d6f16, it took effect on this controller and broke integrations.
This commit explicitly disables CSRF protection on these webhook routes, and updates the specs so they'll catch this kind of regression in future.
6 Me gusta
david
(David Taylor)
Cerrado
20 Junio, 2022 07:00
9
This topic was automatically closed after 6 days. New replies are no longer allowed.