InvalidAuthenticityToken in Devise

Question

I recently added a piece of code to my ApplicationController to set the timezone of the current block to the one specified by the user.

class ApplicationController < ActionController::Base
  around_action :set_time_zone, if: :current_user
  protect_from_forgery with: :exception

  private

  def set_time_zone(&block)
    Time.use_zone(current_user.time_zone, &block)
  end
end

For some reason when I try to sign in i get a

ActionController::InvalidAuthenticityToken in Devise::SessionsController#create

If i remove

around_action :set_time_zone, if: :current_user

I can sign in and if i add it back after I sign in, everything works as expected.

Any ideas?

Answer 1

This page has good info on the problem, but I was weirdly able to fix this in Rails 5 by putting protect_from_forgery above the around_action/filter. Hope it helps!