Devise: Can't verify CSRF token authenticity the HTTPS enabled on server (No JSON/API)

Question

I am setting up a Rails Blog. I am using Rails 5, and Devise 4.2.0. The app runs in production on Ubuntu Server with Nginx and Puma and deployed with Capistrano. Everything works great in production until enabling HTTPS (with valid SSL certificate) on Nginx and adding a 301 redirect form HTTP to HTTPS.

I have checked the production logs and the authenticity keys in the logs do not match the one I see in the browser.

Here is the nginx.conf file I am using:

upstream puma {
  server unix:///home/deploy/apps/example-blog/shared/tmp/sockets/example-blog-puma.sock;
}

server { # Redirect HTTP to HTTPS
  # Bind port(s)
  listen   80;
  listen   [::]:80;

  # Bind domain(s)
  server_name blog.example.com;

  # 301 redirect to HTTPS
  return 301 https://$server_name$request_uri;
}

server { # Primary server block
  # Bind port(s)
  listen   443 default_server ssl;

  # Bind domain(s)
  server_name blog.example.com;

  # Bind certificate(s)
  ssl_certificate       /etc/nginx/ssl/blog.example.com/ssl-bundle.crt;
  ssl_certificate_key   /etc/nginx/ssl/blog.example.com/blog.example.com.key;

  root /home/deploy/apps/example-blog/current/public;
  access_log /home/deploy/apps/example-blog/current/log/nginx.access.log;
  error_log /home/deploy/apps/example-blog/current/log/nginx.error.log info;

  location ^~ /assets/ {
    gzip_static on;
    expires max;
    add_header Cache-Control public;
  }

  try_files $uri/index.html $uri @puma;
  location @puma {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_redirect off;

    proxy_pass http://puma;
  }

  error_page 500 502 503 504 /500.html;
  client_max_body_size 10M;
  keepalive_timeout 10;
}

Does anyone know what might be going on here? Let me know if you need any more information.

Thanks

Answer 1

Added proxy_set_header X-Forwarded-Proto $scheme; to the location @puma which got it going.