Use log.warn instead of debug for CSRF token warning

[md5]

We had a situation where the CSRF token additions in jquery_ujs were lost in a refactor and had a hell of a time tracking down why every post was logging the user out (we have a GET-heavy site and the pattern wasn't immediately clear since it manifested in the one broadly-used POST-based feature).

I poked around and saw the session clearing stuff in the CSRF protection code and realized what our problem was, but then I noticed that the big scary "WARNING" message was being logged with logger.debug. If we had seen that warning message in the development logs, it would have been immediately clear what was happening.

[sikachu]

1. Nice Github username :)
2. It would be great to provide CHANGELOG entry for this.
3. Is there currently a test coverage for warning?

[md5]

Sure, I can add a CHANGELOG entry.

There isn't an existing test for the warning; if you have a comparable example for testing a warning like this, I can try to add that too.

[md5]

Is this a reasonable example to crib from?

https://github.com/rails/rails/blob/master/railties/test/application/initializers/notifications_test.rb

[md5]

Ok, I added the test and a CHANGELOG entry. I added the entry in the 3.2.0 section since I did these changes off of master, but it seems like a reasonable idea for this to go into 3-1-stable too. Not sure how you guys decide that.

Also, I pushed these commits to a different csrf_token_warning branch under md5/rails. I'm not going to be pushing any other commits to my master any time soon, but I can redo the pull request from that branch if you like.

[md5]

I just noticed I used a "rescue" instead of "ensure" when putting the old logger back (I'm a bit of a Ruby/Rails noob). Not sure whether the logger is re-initialized for each test, so this may not have any effect on log output in other tests, but I thought I'd point it out.

[md5]

Here's the commit FWIW: https://github.com/md5/rails/commit/dbef311819c2c6475d156cc74611992ae45f1330

I'm going to continue about my business now and leave you fine people to yours.

[jonleighton]

Please could you submit a PR for the rescue/ensure change and we will merge it. Thanks.

[jonleighton]

Also, great change, I was bitten by this recently.

[spastorino]

@tenderlove bro can you merge this and #2974 to 3-1-stable?

[tenderlove]

@spastorino why do you want this in 3-1-stable? It is a new feature, not a bug fix.

[spastorino]

I don't think it's a feature we were reporting in the wrong level. But anyway unsure if it worth backporting just pinging you to know your thoughts :)