Rails this week: no CSRF tokens under header_only, lazier test gems
Serguey Asael Shinder2 min readThe Rails weekly update for 30 October, written by Claudio Baccigalupo, collects changes merged into the framework's main branch. Several of them alter what a new or upgraded application does without any code change on the developer's side.
New applications generated from now on declare capybara and selenium-webdriver with require: false in the Gemfile. ActionDispatch::SystemTestCase already requires both gems when a system test is loaded, so test processes that never run a system test boot faster.
Applications using the :header_only CSRF strategy, which verifies requests by their Sec-Fetch-Site header and never reads a token, no longer get authenticity tokens rendered by forms, button_to or csrf_meta_tags. The visible effect is that a page's bytes stop changing between requests, which matters for anything that caches or compares responses.
Action Cable now processes the commands of a single connection in order; previously they could run concurrently or out of sequence. The immutable_strings_by_default setting is narrowed to real string columns: it had been catching every type that subclasses ActiveModel::Type::String, so text columns and PostgreSQL's xml, citext, ltree, tsvector and macaddr columns were being inferred as :string.
On the query side, four pull requests fix preloading of has_many :through associations with source_type and conditions, one fixes left_joins and eager_load reusing the wrong join when the same through association is reached from two parent paths, and exists? and calculations now drop default_order, which avoids invalid SQL on PostgreSQL. NumericalityValidator in Active Record and the option accessors on ColumnDefinition are deprecated, the log filter now matches URL-encoded parameter names such as %70assword, and the API documentation moves from RDoc to Markdown.
What it means
Most of this arrives in the next Rails release rather than today, but two items are worth testing early. The left_joins fix changes results that were silently wrong, so queries that hit it will return different rows; and the CSRF change is a reason to check whether anything in a test suite asserted on the presence of a token.