Devise session immediately expiring on .js call [AJAX]

Question

Through much trial and error, I have narrowed the problem down to line 5 below. For some reason, the .js response is ending the user session. Using 3.0.4 and devise 1.1.7

Answer 1

Many thanks to Brandon Martin from the Devise Google Group for pointing me int he right direction...

This is a result of a Rails 3.0.4 security fix.

http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails

After an hour or so of working forward from this blog post, here are some tips for others...

• This has been fixed in rails.js - so you don't have to hack, patch, or reinvent the wheel.
• If you are using rails.js out of the box, update it - rake rails:update (I think, but I use a customized rails.js file)
• If you are using a custom rails.js file, go get the source code to the newest version here: https://github.com/fermion/jquery-ujs/blob/master/src/rails.js
• place your csrf_meta_tag helper above your javascript_include_tags

Hope that helps!