{"action":"created","issue":{"url":"https://api.github.com/repos/refile/refile/issues/185","labels_url":"https://api.github.com/repos/refile/refile/issues/185/labels{/name}","comments_url":"https://api.github.com/repos/refile/refile/issues/185/comments","events_url":"https://api.github.com/repos/refile/refile/issues/185/events","html_url":"https://github.com/refile/refile/issues/185","id":64084336,"number":185,"title":"Can't verify CSRF token authenticity","user":{"login":"niels-s","id":1531951,"avatar_url":"https://avatars.githubusercontent.com/u/1531951?v=3","gravatar_id":"","url":"https://api.github.com/users/niels-s","html_url":"https://github.com/niels-s","followers_url":"https://api.github.com/users/niels-s/followers","following_url":"https://api.github.com/users/niels-s/following{/other_user}","gists_url":"https://api.github.com/users/niels-s/gists{/gist_id}","starred_url":"https://api.github.com/users/niels-s/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/niels-s/subscriptions","organizations_url":"https://api.github.com/users/niels-s/orgs","repos_url":"https://api.github.com/users/niels-s/repos","events_url":"https://api.github.com/users/niels-s/events{/privacy}","received_events_url":"https://api.github.com/users/niels-s/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":16,"created_at":"2015-03-24T19:48:32Z","updated_at":"2015-04-15T06:47:43Z","closed_at":null,"body":"Hey there,\r\n\r\nI'm using Refile 0.5.3 in combination with Rails 3.2.20 and Devise 3.4.1. Now I'm having the strange behaviour on my app. I have everything deployed on a staging environment where they run in perfect harmony together. \r\nHowever when I deployed the code to production environment, things go wrong. \r\n\r\nUploading attachments goes just fine with the refile.js library but from the moment I submit my form I get the following warning: `WARNING: Can't verify CSRF token authenticity`.\r\nAnd as a result I'm redirected to login page again, as you may guess this behaviour is pretty annoying.\r\nI'm hoping somebody could give me some pointers to look at since this is 100% related to refile I assume.\r\n\r\nAll help is really appreciated, thanks!\r\n"},"comment":{"url":"https://api.github.com/repos/refile/refile/issues/comments/93221527","html_url":"https://github.com/refile/refile/issues/185#issuecomment-93221527","issue_url":"https://api.github.com/repos/refile/refile/issues/185","id":93221527,"user":{"login":"jnicklas","id":134,"avatar_url":"https://avatars.githubusercontent.com/u/134?v=3","gravatar_id":"","url":"https://api.github.com/users/jnicklas","html_url":"https://github.com/jnicklas","followers_url":"https://api.github.com/users/jnicklas/followers","following_url":"https://api.github.com/users/jnicklas/following{/other_user}","gists_url":"https://api.github.com/users/jnicklas/gists{/gist_id}","starred_url":"https://api.github.com/users/jnicklas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jnicklas/subscriptions","organizations_url":"https://api.github.com/users/jnicklas/orgs","repos_url":"https://api.github.com/users/jnicklas/repos","events_url":"https://api.github.com/users/jnicklas/events{/privacy}","received_events_url":"https://api.github.com/users/jnicklas/received_events","type":"User","site_admin":false},"created_at":"2015-04-15T06:47:43Z","updated_at":"2015-04-15T06:47:43Z","body":"AHHHHH!!! @Darmody thank you! That's the missing puzzle piece that explains this bug!\r\n\r\njquery-ujs does not support submitting forms with file fields via AJAX, so it won't actually do an AJAX request, it will instead do a regular form post. Unfortunately, when you use `remote: true`, Rails for some dumb reason does *not* add an authenticity token to the form. Instead it relies on jquery-ujs picking up the token from the `<meta>` tag it adds to `<head>`. But since we don't actually use AJAX, the form gets submitted without any authenticity token at all!\r\n\r\nMy suggestion would be to remove `remote: true`, since it doesn't do what you want anyway. If you want to submit the form via AJAX, do it manually with jQuery."}}