Sessions not persisting between requests in system specs

[joshbuker]

What Ruby, Rails and RSpec versions are you using?

Ruby version: 3.0.0
Rails version: 6.1.3.2
RSpec version: 3.10.0

Observed behaviour

When making a request e.g.:

post '/user/login', params:  { login: user.username, password: 'secret' }

The session appears to be set correctly:

session
# => {"_csrf_token"=>"...", "user_id"=>"1", "return_to_url"=>nil, "flash"=>{"discard"=>[], "flashes"=>{"success"=>"Logged in successfully!"}}}

But does not get passed to the next request:

delete '/user/logout'
# within the controller:
session
# => {}

Expected behaviour

session should be correctly passed between requests within a system test run.

Can you provide an example app?

Sorcery/sorcery-rework @ commit a318267

rspec spec/system/user_logout_spec.rb
First byebug:
session # has stuff
Second byebug:
session # should have stuff, but does not

Additional notes

I have the feeling this might be me missing something in my dummy_app setup that's used to mock having a rails app to test against. That said, I've banged my head against this for almost a week now and can't figure out what I'm doing wrong.

[JonRowe]

👋 First up, isn't that by design? https://github.com/Sorcery/sorcery-rework/blob/a31826713bdd98e2a053499163b4eff2ccf31778/sorcery-core/lib/sorcery/controller.rb#L209

You're resetting the session during logout, which is standard, so are you just missing an ordering where some flash should be set after the reset?

Secondly, RSpec Rails provides no session handling ourselves, we're just integrating the Rails system test helpers, so as far as I can see, we wouldn't be the ones dropping the session here.

[joshbuker]

@JonRowe The issue is that session isn't being passed to the request in the first place, which causes it to never hit the logout. (before_action :require_login triggers first, which sees we have no user_id set in the session and boots you to the not_authenticated method)

Is there an expectation that you only call visit / get / post / etc once, and from there do page navigation? That's another scenario I could see that would silently trip me up. (I'm calling post, then delete, which may have some unspecified behavior)

[JonRowe]

rack-test which is the driver I think you're using, is supposed to maintain the session across requests, (again this isn't something RSpec or even Rails actually handles for you, it's Capybara and your driver) prehaps this is to do with not setting say secret key base or something?

[joshbuker]

Rails.application.secrets.secret_key_base returns an appropriate value, so it doesn't appear to be that at least.

Should I go poke the rack-test people about this issue then?

[JonRowe]

But does it stay the same between calls / requests? I would approach various help sites first, github issues are usually not the place to discuss things which are likely to be issues with setup rather than bugs.

[joshbuker]

github issues are usually not the place to discuss things which are likely to be issues with setup rather than bugs.

Good point, I'll start on stackoverflow/similar next time I have a setup issue like this.

I found the issue when trying to replicate the problem with a minimal rails app. You need the following config option when in the test environment:

config.action_controller.allow_forgery_protection = false

Added that to application.rb and it works as expected now. 🤦‍♂️

Thanks for your time @JonRowe, you helped guide me in the right direction.

[JonRowe]

We also have a rspec mailing list see https://rspec.info/help/