Rails and Rack::Protection::AuthenticityToken
<ul>
<li>rails 4.2.6</li>
<li>ruby 2.3</li>
</ul>

<p>I'm having some difficulty to implement the <a href="https://github.com/sinatra/rack-protection" rel="nofollow">rack-protection gem</a> with rails.</p>

<p>The AuthenticityToken protection was enabled in this way:</p>

<pre><code>#application.rb

module MyApp
    class Application &lt; Rails::Application
        config.middleware.use Rack::Protection
        config.middleware.use Rack::Protection::AuthenticityToken
    end
end
</code></pre>

<p>The problem is that I aways get a "Forbidden" when logging with Devise gem.</p>

<p><code>WARN -- : attack prevented by Rack::Protection::AuthenticityToken</code></p>

<p>However the "csrf_meta_tags" are present on the top of every page:</p>

<pre><code>&lt;head&gt;
    &lt;meta name="csrf-param" content="authenticity_token"&gt;
    &lt;meta name="csrf-token" content="+4lRTVfIWBjsgGXEzHFVCIf/Bi/jqqfkLPg6qdw5FMHA1L3Eh36I+hALcRIhv1VjfgTznssJqvRh+/IEMhyNeA=="&gt;
&lt;/head&gt;
</code></pre>

<p>And the authenticity_token is passed as an input hidden inside the session form too:</p>

<pre><code>&lt;input name="authenticity_token" value="+4lRTVfIWBjsgGXEzHFVCIf/Bi/jqqfkLPg6qdw5FMHA1L3Eh36I+hALcRIhv1VjfgTznssJqvRh+/IEMhyNeA==" type="hidden"&gt;
</code></pre>

<p>What am I missing here?</p>

<p><strong>I'm in development mode, not production.</strong></p>

<p>Thanks!</p>