Skipping Rails authenticity for a webhook endpoint results in 401
Sendgrid's event webhooks send POST requests that are for some reason unauthenticated. I've set up a Rails endpoint on my app on Heroku to receive it, however, it just keeps returning a 401 status.
2018-11-12T21:17:20.090837+00:00 heroku[router]: at=info method=POST path="/sendgrid_hooks" host=staging.herokuapp.com request_id=ba07cf74-f1e4-40e2-90a8-b1ac67779333 fwd="167.89.116.63" dyno=web.1 connect=0ms service=2ms status=401 bytes=286 protocol=https
I have tried including skip_before_action :verify_authenticity_token, and putting just a blank head(:ok) in the controller action, and all of this works fine locally (e/g. with Postman), but on Heroku it just endlessly returns 401. Is there something I can do to avoid the auth? AFAIK I'm not adding any before actions for any other request authorization (e.g. no devise, etc).
Controller:
class MyHooksController < ActionController::Base
protect_from_forgery with: :exception
skip_before_action :verify_authenticity_token, only: :create
def show
head(:ok)
end
def create
head(:ok)
end
end
ruby-on-rails heroku
asked Nov 12 '18 at 21:37
tastycakemantastycakeman
11
add a comment |
Sendgrid's event webhooks send POST requests that are for some reason unauthenticated. I've set up a Rails endpoint on my app on Heroku to receive it, however, it just keeps returning a 401 status.
2018-11-12T21:17:20.090837+00:00 heroku[router]: at=info method=POST path="/sendgrid_hooks" host=staging.herokuapp.com request_id=ba07cf74-f1e4-40e2-90a8-b1ac67779333 fwd="167.89.116.63" dyno=web.1 connect=0ms service=2ms status=401 bytes=286 protocol=https
I have tried including skip_before_action :verify_authenticity_token, and putting just a blank head(:ok) in the controller action, and all of this works fine locally (e/g. with Postman), but on Heroku it just endlessly returns 401. Is there something I can do to avoid the auth? AFAIK I'm not adding any before actions for any other request authorization (e.g. no devise, etc).
Controller:
class MyHooksController < ActionController::Base
protect_from_forgery with: :exception
skip_before_action :verify_authenticity_token, only: :create
def show
head(:ok)
end
def create
head(:ok)
end
end
ruby-on-rails heroku
asked Nov 12 '18 at 21:37
tastycakemantastycakeman
11
post your application controller and the webhooks controller
– Lenin Raj Rajasekaran
Nov 12 '18 at 21:46
add a comment |
Sendgrid's event webhooks send POST requests that are for some reason unauthenticated. I've set up a Rails endpoint on my app on Heroku to receive it, however, it just keeps returning a 401 status.
2018-11-12T21:17:20.090837+00:00 heroku[router]: at=info method=POST path="/sendgrid_hooks" host=staging.herokuapp.com request_id=ba07cf74-f1e4-40e2-90a8-b1ac67779333 fwd="167.89.116.63" dyno=web.1 connect=0ms service=2ms status=401 bytes=286 protocol=https
I have tried including skip_before_action :verify_authenticity_token, and putting just a blank head(:ok) in the controller action, and all of this works fine locally (e/g. with Postman), but on Heroku it just endlessly returns 401. Is there something I can do to avoid the auth? AFAIK I'm not adding any before actions for any other request authorization (e.g. no devise, etc).
Controller:
class MyHooksController < ActionController::Base
protect_from_forgery with: :exception
skip_before_action :verify_authenticity_token, only: :create
def show
head(:ok)
end
def create
head(:ok)
end
end
ruby-on-rails heroku
asked Nov 12 '18 at 21:37
tastycakemantastycakeman
11
Sendgrid's event webhooks send POST requests that are for some reason unauthenticated. I've set up a Rails endpoint on my app on Heroku to receive it, however, it just keeps returning a 401 status.
2018-11-12T21:17:20.090837+00:00 heroku[router]: at=info method=POST path="/sendgrid_hooks" host=staging.herokuapp.com request_id=ba07cf74-f1e4-40e2-90a8-b1ac67779333 fwd="167.89.116.63" dyno=web.1 connect=0ms service=2ms status=401 bytes=286 protocol=https
I have tried including skip_before_action :verify_authenticity_token, and putting just a blank head(:ok) in the controller action, and all of this works fine locally (e/g. with Postman), but on Heroku it just endlessly returns 401. Is there something I can do to avoid the auth? AFAIK I'm not adding any before actions for any other request authorization (e.g. no devise, etc).
Controller:
class MyHooksController < ActionController::Base
protect_from_forgery with: :exception
skip_before_action :verify_authenticity_token, only: :create
def show
head(:ok)
end
def create
head(:ok)
end
end
ruby-on-rails heroku
ruby-on-rails heroku
asked Nov 12 '18 at 21:37
tastycakemantastycakeman
11
asked Nov 12 '18 at 21:37
tastycakemantastycakeman
11
edited Nov 12 '18 at 22:56
tastycakeman
asked Nov 12 '18 at 21:37
tastycakemantastycakeman
11
asked Nov 12 '18 at 21:37
tastycakemantastycakeman
11
asked Nov 12 '18 at 21:37
tastycakemantastycakeman
11
11
post your application controller and the webhooks controller
– Lenin Raj Rajasekaran
Nov 12 '18 at 21:46
add a comment |
post your application controller and the webhooks controller
– Lenin Raj Rajasekaran
Nov 12 '18 at 21:46
post your application controller and the webhooks controller
– Lenin Raj Rajasekaran
Nov 12 '18 at 21:46
post your application controller and the webhooks controller
– Lenin Raj Rajasekaran
Nov 12 '18 at 21:46
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53270458%2fskipping-rails-authenticity-for-a-webhook-endpoint-results-in-401%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53270458%2fskipping-rails-authenticity-for-a-webhook-endpoint-results-in-401%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
post your application controller and the webhooks controller
– Lenin Raj Rajasekaran
Nov 12 '18 at 21:46