ActionController::InvalidAuthenticityToken + Cloudflare full(strict) SSL/TLS encryption

[AlexB52]

Hi everyone,

I used the information in this awesome discussion to get a full(strict) SSL/TLS with Cloudflare using Kamal on a Rails app. Everything was working until now.

I have a demo app that used to work a few weeks ago but now doesn't. What doesn't work are POST requests where I get a 422 unprocessable entity. I can add skip_forgery_protection in controllers to fix the issue but I find it weird that I have to do this now when I didn't before. It's been a few weeks and now I get Traefik logs to complain about TLS.

I didn't look at the app for 3 weeks but no configuration has changed and yet I get 422 on POST requests after a few deploys.

Traefik logs

2023-11-09T06:43:15.597001701Z time="2023-11-09T06:43:15Z" level=debug msg="Serving default certificate for request: \"www.speedtest.org\""
2023-11-09T06:43:15.980770946Z time="2023-11-09T06:43:15Z" level=debug msg="http: TLS handshake error from 5.208.17.51:59688: remote error: tls: bad certificate"

docker logs

[c6f13638-b2a8-452b-8d8a-600b8a68df3e] ActionController::InvalidAuthenticityToken (Can't verify CSRF token authenticity.):
[c6f13638-b2a8-452b-8d8a-600b8a68df3e]   
[c6f13638-b2a8-452b-8d8a-600b8a68df3e] actionpack (7.1.1) lib/action_controller/metal/request_forgery_protection.rb:293:in `handle_unverified_request'
[c6f13638-b2a8-452b-8d8a-600b8a68df3e] actionpack (7.1.1) lib/action_controller/metal/request_forgery_protection.rb:388:in `handle_unverified_request'
[c6f13638-b2a8-452b-8d8a-600b8a68df3e] actionpack (7.1.1) lib/action_controller/metal/request_forgery_protection.rb:377:in `verify_authenticity_token'

Any idea what could have gone wrong?

[AlexB52]

It seems to work again now 🤷