Invalid login credentials. Please try again.

[alexfalkowski]

Question, I am sorry if this is something dumb.

When I do:

curl -v -H 'Content-Type: application/json' http://localhost:5000/users/sign_in -d '{"email": "ron.burgundy@test.com", "password": "test1234" }'

I get

*   Trying ::1...
* TCP_NODELAY set
* Connection failed
* connect to ::1 port 5000 failed: Connection refused
*   Trying fe80::1...
* TCP_NODELAY set
* Connection failed
* connect to fe80::1 port 5000 failed: Connection refused
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 5000 (#0)
> POST /users/sign_in HTTP/1.1
> Host: localhost:5000
> User-Agent: curl/7.51.0
> Accept: */*
> Content-Type: application/json
> Content-Length: 59
>
* upload completely sent off: 59 out of 59 bytes
< HTTP/1.1 200 OK
< X-Frame-Options: SAMEORIGIN
< X-XSS-Protection: 1; mode=block
< X-Content-Type-Options: nosniff
< Content-Type: application/json; charset=utf-8
< access-token: r_j-oh2WMqwA4-I4VUtuiQ
< token-type: Bearer
< client: nDGdR6gmNdgF-lCSk8lKxg
< expiry: 1486893331
< uid: ron.burgundy@test.com
< ETag: W/"b6fc9e83fe6cbfb0e25df3096e5f5716"
< Cache-Control: max-age=0, private, must-revalidate
< X-Request-Id: 3231a9bb-83e5-4672-b2c8-d10b8f07da4b
< X-Runtime: 0.268175
< Transfer-Encoding: chunked
<
* Curl_http_done: called premature == 0
* Connection #0 to host localhost left intact
{"data":{"id":4,"email":"ron.burgundy@test.com","provider":"email","uid":"ron.burgundy@test.com","name":null,"nickname":null,"image":null}}%

Though when I do:

curl -v -H 'Content-Type: application/json' http://localhost:5000/users/sign_in -d '{"user": {"email": "ron.burgundy@test.com", "password": "test1234" }}'

I get

*   Trying ::1...
* TCP_NODELAY set
* Connection failed
* connect to ::1 port 5000 failed: Connection refused
*   Trying fe80::1...
* TCP_NODELAY set
* Connection failed
* connect to fe80::1 port 5000 failed: Connection refused
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 5000 (#0)
> POST /users/sign_in HTTP/1.1
> Host: localhost:5000
> User-Agent: curl/7.51.0
> Accept: */*
> Content-Type: application/json
> Content-Length: 69
>
* upload completely sent off: 69 out of 69 bytes
< HTTP/1.1 401 Unauthorized
< X-Frame-Options: SAMEORIGIN
< X-XSS-Protection: 1; mode=block
< X-Content-Type-Options: nosniff
< Content-Type: application/json; charset=utf-8
< Cache-Control: no-cache
< X-Request-Id: 3338218b-d44c-4251-8580-9f34fe550ff8
< X-Runtime: 0.006360
< Transfer-Encoding: chunked
<
* Curl_http_done: called premature == 0
* Connection #0 to host localhost left intact
{"errors":["Invalid login credentials. Please try again."]}%

No idea why.

This is what I am running:

• Rails 5.0.1 - API version
• devise_token_auth (0.1.40)
• devise (4.2.0)

Appreciate your patience.

[alexfalkowski]

This is from the rails logs

17:56:46 web.1    | Started POST "/users/sign_in" for 127.0.0.1 at 2017-01-29 17:56:46 +0800
17:56:46 web.1    | Processing by DeviseTokenAuth::SessionsController#create as */*
17:56:46 web.1    |   Parameters: {"user"=>{"email"=>"ron.burgundy@test.com", "password"=>"[FILTERED]"}}
17:56:46 web.1    | Unpermitted parameter: user
17:56:46 web.1    | {"errors":["Invalid login credentials. Please try again."]}
17:56:46 web.1    | Completed 401 Unauthorized in 3ms (Views: 0.5ms | ActiveRecord: 0.0ms)

[alexfalkowski]

I am using https://github.com/simplabs/ember-simple-auth with DeviseAuthenticator

[alexfalkowski]

Looking at https://github.com/simplabs/ember-simple-auth/blob/master/addon/authenticators/devise.js#L43

It expects a key.

[wrfarina]

@alexfalkowski can you paste the output of rake:routes? I suspect you should use the URL http://localhost:5000/auth/sign_in

[alexfalkowski]

If you look at the above it defaults to user so I mapped it there, does it have to be auth. I didn't think it mattered what the URL is. The curl commands show it only accepts those parameters.

Looking at the doco

Email registration. Requires email, password, and password_confirmation params. A verification email will be sent to the email address provided. Accepted params can be customized using the devise_parameter_sanitizer system.

It says it only expects those parameters. So I am assuming this is not configurable.

[stephanebruckert]

Solution given on https://stackoverflow.com/questions/33268872/unpermitted-parameter-using-devise-token-auth-gem-in-rails-api

The idea is to extend ember-simple-auth/addon/authenticators/devise.js.

Credits to @ahmadsoe

---

[zachfeldman]

Thanks @stephanebruckert for the solution! Closing this for now