devise: DisabledSessionError when using authenticate_user! api only

I understand that Devise relies heavily on warden etc which rely on sessions, or a fake version of it at least. Thus, we’ve circumvented this by creating this concern/module that we have included in the relevant Devise-related controllers in our app:

module RackSessionFixController
  extend ActiveSupport::Concern

  class FakeRackSession < Hash
    def enabled?
      false
    end
  end

  included do
    before_action :set_fake_rack_session_for_devise
    
    private

    def set_fake_rack_session_for_devise
      request.env['rack.session'] ||= FakeRackSession.new
    end
  end
end

if the devise maintainers like it, we (AKA me or my team) can integrate this into Devise itself (E.g. allowing that logic to happen when API-mode is enabled) and expand the testsuite accordingly.

@carlosantoniodasilva WDYT ?

No news 😃, but thanks for putting it into my radar again, I’ll try to take a better look at the problem and the proposed solution(s) here. Thanks.

FYI, I am preparing a PR for this issue. To begin with, we’ll have a fork with the fix applied which is slightly better than the module-drop-in there, but I really want to make it upstream into the official branch.

@NfoCipher I was waiting for an OK here to create the PR. BUT, since I got no answer … I’ll create the PR so that at least people can have a branch to point to, and will push to make it merged…

@arpu you need to drop that module I wrote in my earlier comment and include it in the SessionControllers. If @carlosantoniodasilva or other maintainer can suggest their acceptance, I can for sure make it included in devise itself so that it’s automatic.

In case this helps someone, you’ll also need to pass in store: false for logging in.

This needs to be added to the controller inherited from Devise::SessionsController

  def auth_options
    super.merge({store: false})
  end

This: https://github.com/waiting-for-dev/devise-jwt/issues/235#issuecomment-1116864740 also seems to work.