# Sudden failure of redirect in ActionController +verify+

**URL:** <https://www.ruby-forum.com/t/sudden-failure-of-redirect-in-actioncontroller-verify/151979>\
**Category:** Rails\
**Created:** [October 28, 2008, 5:19pm UTC](https://www.ruby-forum.com/t/sudden-failure-of-redirect-in-actioncontroller-verify/151979 "2008-10-28T17:19:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![fritza](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/5f9b8f/32.png) [@fritza](https://www.ruby-forum.com/u/fritza)\
**Post date:** [October 28, 2008, 5:19pm UTC](https://www.ruby-forum.com/t/sudden-failure-of-redirect-in-actioncontroller-verify/151979/1 "2008-10-28T17:19:18Z")

</div>

= SUMMARY

An ActionController +verify+ directive redirects to an :action if  
certain actions are not done by POST. In one case, the redirect is to an  
empty hash instead; in another, nearly identical, it is to the correct  
hash. This is seen in a functional test.

Will someone please tell me what is going wrong, and how I can correct  
it?

= ENVIRONMENT

$ ruby --version  
ruby 1.8.6 (2008-03-03 patchlevel 114) [universal-darwin9.0]  
$ rails --version  
Rails 1.2.6

= DETAIL

(Much of this may be easier to see in the “CODE” section, below.)

AdminController is a subclass of ActionController, acting on instances  
of Permission, an ActiveRecord subclass. Permission#approve and  
Permission#deny set the :approval attribute to one string or another.  
admin/approve/:id and admin/deny/:id pass the respective methods to the  
id’ed Permission.

AdminController has a +verify+ directive to require that #approve and  
#deny be done by POST. If they are not, the session is to :redirect\_to  
admin/list.

Class AdminControllerTest, a Test::Unit::TestCase, challenges the  
+verify+ by using GET requests instead. For many iterations of the test,  
AdminController passed. I then added some tests to AdminControllerTest;  
I did not change test\_deny\_not\_post or test\_accept\_not\_post.

test\_deny\_not\_post then started failing at assert\_redirected\_to. The  
fail message is:

“response is not a redirection to all of the options supplied  
(redirection is \<{}\>), difference: \<{“action”=\>:list}\>”

test\_approve\_not\_post, which is nearly identical, DOES NOT fail.

Changing the +verify+'s :redirect\_to to { :controller =\> :admin, :action  
=\> :list } gets the tests past the assert\_redirected\_to, but fails the  
follow\_redirect (Can’t follow redirects outside of current controller  
(from admin to admin)). This failure is in BOTH test\_deny\_not\_post and  
test\_approve\_not\_post.

My controller is failing a functional test, and I don’t understand why.  
Will someone please tell me what is going wrong, and how I can correct  
it?

= CODE (abridged)

class AdminController \< ApplicationController  
verify :method =\> :post, :only =\> [ :destroy, :create, :update,  
:deny, :approve ],  
:redirect\_to =\> { :action =\> :list },  
:add\_flash =\> { :notice =\> ‘You cannot do this directly.’ }

def approve  
# before\_filter sets @permission  
@permission.approve  
if @permission.save  
flash[:notice] = ‘This request was approved.’  
else  
flash[:notice] = ‘Could not approve the request (internal  
error).’  
end  
redirect\_to :action =\> :list  
end

def deny  
# before\_filter sets @permission  
@permission.deny  
if @permission.save  
flash[:notice] = ‘This request was denied.’  
else  
flash[:notice] = ‘Could not deny the request (internal error).’  
end  
redirect\_to :action =\> :list  
end

class AdminControllerTest \< Test::Unit::TestCase

# #setup puts user credentials in @session

def test\_approve\_not\_post  
get :approve, { :id =\> 3 }, @session  
assert\_response :redirect  
assert\_redirected\_to :action =\> :list  
assert\_equal ‘You cannot do this directly.’, flash[:notice]  
end

def test\_deny\_not\_post  
get :deny, { :id =\> 3 }, @session  
assert\_response :redirect  
assert\_redirected\_to :action =\> :list  
assert\_equal ‘You cannot do this directly.’, flash[:notice]  
end  
end

---

<div class="post-metadata">

**Author:** ![fritza](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/5f9b8f/32.png) [@fritza](https://www.ruby-forum.com/u/fritza)\
**Post date:** [October 28, 2008, 7:11pm UTC](https://www.ruby-forum.com/t/sudden-failure-of-redirect-in-actioncontroller-verify/151979/2 "2008-10-28T19:11:44Z")

</div>

I’ve narrowed the problem a bit. It now seems that follow\_redirect in  
one test will break an ActionController’s +verify+ directive in another,  
later test.

I am ashamed to say my code fragment was not accurate. Here is the  
correct code:

======  
class AdminControllerTest \< Test::Unit::TestCase  
# #setup puts user credentials in @session

```
def test_approve_not_post
    get :approve, { :id => 3 }, @session
    assert_response :redirect
    assert_redirected_to :action => :list
    assert_equal 'You cannot do this directly.', flash[:notice]

    ### OMITTED IN ORIGINAL - SORRY ###
    follow_redirect
    assert_response :success
end

def test_deny_not_post
    get :deny, { :id => 3 }, @session
    assert_response :redirect
    assert_redirected_to :action => :list
    assert_equal 'You cannot do this directly.', flash[:notice]

    ### OMITTED IN ORIGINAL - SORRY ###
    follow_redirect
    assert_response :success
end

```

# end

Note that I have the tests follow the redirect\_to arising from the  
failed +verify+.

I have discovered that if I comment-out the follow\_redirect and  
assert\_response calls in test\_approve\_not\_post, then +verify+ will  
redirect correctly in test\_deny\_not\_post. Remember it was the  
assert\_redirected\_to, and the redirection hash, that broke.

So now: follow\_redirect breaks an ActionController’s +verify+ handling.  
before\_filter and after\_filter don’t have this problem. Is this a  
peculiarity of functional tests – and can I therefore ignore it? I’d  
rather be able to test the redirection.

Should I update beyond Rails 1.2.6? 2.x is not feasible for my  
deployment.

Again, I’m sorry about mischaracterizing the code.