Wsrtjtyk

I'm experimenting with ActiveStorage, because I want to create a Rails app where the user can upload directly to DigitalOcean spaces.

However, I have already run into a CSRF problem.

I have declared digital ocean in my storage.yml:

do:

  service: S3

  access_key_id: this_is_a_secret

  secret_access_key: this_is_also_a_secret

  region: ams3

  bucket: this_is_also_a_secret

  endpoint: 'https://this_is_also_a_secret.ams3.digitaloceanspaces.com'

I have chosen that storage service in my development.rb

config.active_storage.service = :do

and I have added the aws gem to Gemfile

gem "aws-sdk-s3", require: false

I have required activestorage in my javascript bundle.

and I have added the following to my view for testing:

= form_for(VideoUpload.first, url: "/") do |form|

  div = form.file_field :file, direct_upload: true

  div = form.submit("Send that file")

When I submit the form, the activestorage.js library kicks in. It calls http://127.0.0.1:3000/rails/active_storage/direct_uploads which in turns throws a 422 due to a missing CSRF token. I have inspected the request and the controller is not wrong. There is no CSRF token set in the HTTP headers, X-CSRF-Token is oddly set to undefined.

The request body contains: {"blob":{"filename":"9T6qqsA-png-wallpapers.jpg","content_type":"image/jpeg","byte_size":122990,"checksum":"gqU9VBgS9mmH7s45qHIbug=="}}, so no CSRF token here either.

But the form in which the input file element is specified contains a token, so I would assume that activestorage.js would pick it up.

What am I missing here? The documentation at https://edgeguides.rubyonrails.org/active_storage_overview.html#direct-uploads doesn't imply that any special configuration in the JS side is necessary.

I am using Rails 5.2.1 and Ruby 2.5.1