User not being placed in the session after Rails 4.2-5.2 upgrade

[brandoncc]

Configuration

• Sorcery Version: 0.13.0
• Ruby Version: 2.3.5
• Framework: Rails 5.2
• Platform: Mac

Expected Behavior

When I call #login in my controller it should place the user id in the session.

Actual Behavior

When I call #login in my controller, it returns the user as it should. It doesn't place the user in the session though so it isn't actually logged in. I have a feeling it is some configuration that should be changed due to my Rails 4.2->5.2 and Sorcery 0.9.1->0.13.0 upgrades which caused this, I just don't know what it is.

Steps to Reproduce

I'm not sure how to reproduce it in any app other than my specific situation.

[joshbuker]

@brandoncc I would check the wiki and make sure your controller code looks up to date. (~3 years since 0.9.1)

Assuming everything looks good, I would try stepping the versions up in smaller increments, and see if you can narrow down which version breaks your application. That would give a better idea of where to look.

[brandoncc]

I checked the source code against my methods and they seem to function as intended, I actually think it is probably more a Rails issue than a Sorcery issue, I was just hoping someone else had the same issue and knew the solution. Is there a newer example than the rails 3 example? I'll see if I can get it to run on a lower version now that I finally got rails 5 running, I had to upgrade a lot of gems to get it to run, so it makes it hard to know what happened since I couldn't just upgrade one gem at a time.

Thanks!

[brandoncc]

I was actually able to go back to 0.9.1 and it worked, I'm not sure why I upgraded at all now. In any case, I figured out that 0.11.0 is what broke it. 0.10.3 works fine.

[joshbuker]

I don't see any commits that look like they would break compatibility. Weird that it only breaks after 0.11.0.. I know there's a file that rails generates when migrating to version 5, I would recommend looking at that and see if anything looks like a potential cause. Beyond that, I'll need some more information to help more.

[brandoncc]

Thanks for the help @athix, I will probably stick with 0.10.3 for now so I can at least get things running right on Rails 5, then I can revisit this.

[joshbuker]

No problem, good luck!

[brandoncc]

@athix I went back to my properly functioning Rails 4.2 app and replicated this. When I upgrade to 0.10.3, all is well. When I go to 0.11.0, the user does not persist in the session again. What can I share with you that will help you help me debug? Thanks again.

[joshbuker]

@brandoncc let's start off with making sure the params are being passed properly. Can you use byebug or a similar tool, and check params before the login method gets called? Also, just to be sure it's not a separate issue, please also check session[:user_id] before and after login gets called. We'll want to do this for 0.10.3 and 0.11.0 to see if there's any differences.

Also don't forget to sanitize any sensitive data if posting the stack trace.

[brandoncc]

0.10.3:

[1] pry(#<SessionsController>)> params
=> {"utf8"=>"✓",
 "authenticity_token"=>"pw1R4yWN2oJ6ea8SCz8f0ZlSE5nMDcDGCy3FIWHmCm2dDsq7Kxs9WbjgMOXbB+Ivg6QzUiw==",
 "email"=>"myemail@gmail.com",
 "password"=>"password",
 "commit"=>"Sign in",
 "controller"=>"sessions",
 "action"=>"create"}

0.11.0:

[1] pry(#<SessionsController>)> params
=> {"utf8"=>"✓",
 "authenticity_token"=>"5zyFKYgxOPTDfrj115Av7oaaLWYTSJOv69RRikS0Je8HKAAoKgVWR9pKlBhia2P/U7YO22VFgptQ==",
 "email"=>"myemail@gmail.com",
 "password"=>"password",
 "commit"=>"Sign in",
 "controller"=>"sessions",
 "action"=>"create"}

0.11.0 before #login call:

[3] pry(#<SessionsController>)> session["user_id"]
=> nil

0.11.0 after #login call:

[1] pry(#<SessionsController>)> session["user_id"]
=> nil

I found something interesting... I did bundle open sorcery and I placed a pry as the first line inside of the user_class.authenticate block. It doesn't get called! If it helps you debug, my user class is Account

[joshbuker]

@brandoncc interesting. Does your Account class call authenticates_with_sorcery!?

Also, try replacing your config with the latest version. The following lines might be what's giving you trouble:

• 277 - # user.subclasses_inherit_config =
• 530 - config.user_class = 'Account'

Edit: replaced <%= model_class_name %> with your model.

[brandoncc]

That is the first few lines of account.rb. Unfortunately those lines are the same in my sorcery config and updating the file from the template didn't have any effect :-/

[joshbuker]

Damn, it was worth a shot.

Can you try checking 0.10.3 to make sure it's setting session[:user_id]? It's important to test both the same way, as testing just one doesn't tell us if there was a change between versions. (I think rails does differentiate between a symbol and string when used as an index) What I'm expecting to see is 0.10.3 has the ID after login, but 0.11.0 does not.

Also, can you use pry inside the login method, immediately before the user_class.authenticate block? We'll want to inspect user_class to make sure it's present, and that it responds to the authenticate method. If you never hit that pry either, then it might be that a controller is overwriting the login method.

Edit: Overwriting shouldn't be version dependent, so it's more likely an issue with the block failing silently.

[brandoncc]

I just verified that session[:user_id] gets set in 0.10.3. I then did the same test in 0.11.0 again and it was nil as usual.

user_class returns Account, and user_class.authenticate returns nil if I pass it invalid info and the correct user if I pass it valid credentials. The block still doesn't get called :-/