Can't verify accounts in a Rails 7.1 app

[Samuelodan]

Hi there,
I get this error when use the verify account link I get upon sign up:
There was an error verifying your account: invalid verify account key

Not sure what the reason is.

Edit: It is a new Rodauth install in a Rails full stack app. And I don't think this issue was happening before, as my auth test would pass occasionally, but it just won't anymore.

[janko]

Could you post the corresponding SQL logs? Can you see anything from them gives a clue why the verify account key (or the account) wouldn't get found? Do you have some special Rodauth configuration that affects querying, such as handling different account types? I can only guess, it would be ideal if you could reproduce this in the official demo app.

[Samuelodan]

Okay. It doesn't even make any SQL queries to get the key. It just does this:

[ActiveJob] [ActionMailer::MailDeliveryJob] [41439a96-ab62-46c8-885a-a9f04365dc1e] Performed ActionMailer::MailDeliveryJob (Job ID: 41439a96-ab62-46c8-885a-a9f04365dc1e) from Async(default) in 140.24ms
Started GET "/verify-account?key=018d4234-6335-7e0a-818c-878d06c8e2af_G1yVY-L8zvC2KZmyOoG--a2J1vbPcVpbHrTvVyyolZw" for ::1 at 2024-01-25 21:00:06 +0100
Processing by RodauthApp#call as HTML
  Parameters: {"key"=>"018d4234-6335-7e0a-818c-878d06c8e2af_G1yVY-L8zvC2KZmyOoG--a2J1vbPcVpbHrTvVyyolZw"}
Redirected to /verify-account
Completed 302 Found in 1ms (ActiveRecord: 0.0ms | Allocations: 152)


Started GET "/verify-account" for ::1 at 2024-01-25 21:00:06 +0100
Processing by RodauthApp#call as HTML
Redirected to /login
Completed 302 Found in 3ms (ActiveRecord: 0.0ms | Allocations: 664)


Started GET "/login" for ::1 at 2024-01-25 21:00:06 +0100
Processing by RodauthApp#call as HTML
  Rendering layout layouts/application.html.erb
  Rendering rodauth/login.html.erb within layouts/application
  Rendered rodauth/_login_form.html.erb (Duration: 3.2ms | Allocations: 3287)
  Rendered rodauth/_login_form_footer.html.erb (Duration: 0.6ms | Allocations: 265)
  Rendered rodauth/login.html.erb within layouts/application (Duration: 7.2ms | Allocations: 4110)
  Rendered layout layouts/application.html.erb (Duration: 11.3ms | Allocations: 5623)
Completed 200 OK in 15ms (Views: 14.8ms | ActiveRecord: 0.0ms | Allocations: 5946)

No error in the logs, just a redirect to the login page. My Rodauth config is almost stock, except for some stuff in a before_create_account hook:

    before_create_account do
      throw_error_status(422, "first_name", "must be present") if param("first_name").empty?
      throw_error_status(422, "last_name", "must be present") if param("last_name").empty?

      # add custom attributes before account creation
      account[:id] = UUID7.generate
      account[:first_name] = param("first_name")
      account[:last_name] = param("last_name")
    end

It's strange to me.

[janko]

Do you have convert_token_id_to_integer? set to true in your Rodauth configuration? If yes, you need to set it to false, because you're using a string primary key on accounts. I think that might be converting the UUID in the token to nil, and considering token as invalid.

[Samuelodan]

Yess!! That fixed it. Thank you so much. You rock!
BTW, is that option a recent addition? I noticed it wasn't there in my previous install (in a Rails API app).

[janko]

Yes, I added it recently. It was to prevent making DB connections on boot when eager loading was enabled locally.

This feature exists to a prevent potential DoS vector on Postgres, where the attacker can force a sequential scan by providing a too large integer, see this article.

I would like to somehow warn when this was turned on for integer columns. But I still don't want to make DB calls on boot. Maybe it's worth turning it off for convenience 🤷🏻‍♂️