Question

I installed Devise and Cancan. My user has role super_admin with options shown below:

def initialize(user)
  user ||= User.new # guest user
  can :manage, :all
end

all works well except deleting elements. When I’m trying to delete object:

<%= link_to 'Destroy', place, :method => :delete, :data => { :confirm => 'Are you sure?' } %>

it keeps logging me out and redirecting to sign_in page

My class looks like that:

class PlacesController < ApplicationController
   before_filter :authenticate_user!
   load_and_authorize_resource

Answer 1

Ok, I figured it out.

My layout file did not have authenticity_token tag

<%= csrf_meta_tag %>

so POST and DELETE requests couldn’t have been authenticated.