{"action":"created","issue":{"url":"https://api.github.com/repos/gonzalo-bulnes/simple_token_authentication/issues/173","labels_url":"https://api.github.com/repos/gonzalo-bulnes/simple_token_authentication/issues/173/labels{/name}","comments_url":"https://api.github.com/repos/gonzalo-bulnes/simple_token_authentication/issues/173/comments","events_url":"https://api.github.com/repos/gonzalo-bulnes/simple_token_authentication/issues/173/events","html_url":"https://github.com/gonzalo-bulnes/simple_token_authentication/issues/173","id":84078314,"number":173,"title":"fallback_to_devise: false seams broken","user":{"login":"pywebdesign","id":2092844,"avatar_url":"https://avatars.githubusercontent.com/u/2092844?v=3","gravatar_id":"","url":"https://api.github.com/users/pywebdesign","html_url":"https://github.com/pywebdesign","followers_url":"https://api.github.com/users/pywebdesign/followers","following_url":"https://api.github.com/users/pywebdesign/following{/other_user}","gists_url":"https://api.github.com/users/pywebdesign/gists{/gist_id}","starred_url":"https://api.github.com/users/pywebdesign/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pywebdesign/subscriptions","organizations_url":"https://api.github.com/users/pywebdesign/orgs","repos_url":"https://api.github.com/users/pywebdesign/repos","events_url":"https://api.github.com/users/pywebdesign/events{/privacy}","received_events_url":"https://api.github.com/users/pywebdesign/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-06-02T15:42:59Z","updated_at":"2015-06-11T18:33:07Z","closed_at":null,"body":"Hi,\r\n\r\nI have been trying for a logn time to understand this. I have a rails app with devise and omniauth (with sessions and sessions cookie and everything). I installed this gem this way on a controller for my api end point:\r\n\r\n````ruby\r\nclass ApplicationApi < ApplicationControllerBase\r\n  protect_from_forgery with: :null_session\r\n  acts_as_token_authentication_handler_for User, fallback_to_devise: false\r\n  skip_before_action :verify_authenticity_token\r\n...\r\nend\r\n````\r\n\r\nand here's what in my User model:\r\n````ruby\r\n  acts_as_token_authenticatable\r\n  # ======\r\n  #\r\n  # Include default devise modules. Others available are:\r\n  # :confirmable, :lockable, :timeoutable and :omniauthable\r\n  devise :database_authenticatable, :registerable,\r\n         :recoverable, :rememberable, :trackable, :validatable,\r\n         :omniauthable, omniauth_providers: [:linkedin]\r\n...\r\n````\r\nIt generates the right behavior when accessing the api endpoint from a json \"browser\" like postman. But on a html browser, if I am already loggued in with session and cookie through normal devise behaviour, it permits me to access my api, even without a token and even if I specify to not fall back to devise.\r\n\r\nIs this normal behaviour? I have read many issue but didn't find a way to \"fix\" this.\r\n\r\nThank you very much.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/gonzalo-bulnes/simple_token_authentication/issues/comments/111233507","html_url":"https://github.com/gonzalo-bulnes/simple_token_authentication/issues/173#issuecomment-111233507","issue_url":"https://api.github.com/repos/gonzalo-bulnes/simple_token_authentication/issues/173","id":111233507,"user":{"login":"pywebdesign","id":2092844,"avatar_url":"https://avatars.githubusercontent.com/u/2092844?v=3","gravatar_id":"","url":"https://api.github.com/users/pywebdesign","html_url":"https://github.com/pywebdesign","followers_url":"https://api.github.com/users/pywebdesign/followers","following_url":"https://api.github.com/users/pywebdesign/following{/other_user}","gists_url":"https://api.github.com/users/pywebdesign/gists{/gist_id}","starred_url":"https://api.github.com/users/pywebdesign/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pywebdesign/subscriptions","organizations_url":"https://api.github.com/users/pywebdesign/orgs","repos_url":"https://api.github.com/users/pywebdesign/repos","events_url":"https://api.github.com/users/pywebdesign/events{/privacy}","received_events_url":"https://api.github.com/users/pywebdesign/received_events","type":"User","site_admin":false},"created_at":"2015-06-11T18:33:07Z","updated_at":"2015-06-11T18:33:07Z","body":"Would you like to check on my code? whatever you need to do your research. \r\n\r\nDon't feel forced, it's not your problem after all, it's mine! I will find a way eventually. \r\n\r\nI am gonna try to search on that too this week or next week.\r\n\r\nhave a great time!"}}