Search code examples
rubyencryptiondeviseruby-on-rails-5

Invalid Reset Password token with multiple app servers


Environment

Ruby ruby-2.5.3(RVM)

Rails 5.2.3

Devise 4.7.0

Issue

The issue with decrypt reset_password_token from the token which we get from reset password instructions email using with two app servers. But, when we get a request to one of the app servers it is working fine but not another app server. Maybe, It is working fine from the server-generated reset password token encrypted. Please check below full details.

Email URL -> /users/password/edit?reset_password_token=tNw1nqXqAa6c8Y9yUkGg

APP Server 1 -> decrypted token with above token -> 6376d5b06682e8c0e627458a6a5654706c30a61ef19c1b2a985fbaa1aade1072

APP Server 2 -> decrypted token with above email token -> b1040564c63d8f3336bddc050f06a6e4b04c6df06718643f7b9bea050c02631a

When request sends to APP server 2 it will work fine because in the database this reset password token got saved. But, If request sends to the APP server 1 not working. I need a solution to seamless with any APP server. It might be an issue with encrypting or decrypt token within APP servers. Thanks in advance!


Solution

  • The token is generated and decrypted using secret_key_base, since they are different in these two services, everything does not work.

    You need to register the same secret_key_base in your services.