ruby on rails 4 - CSRF token session_store with ember-simple-auth alongside Devise -

is possible implement rails csrf through cookie_store @ same while using ember-simple-auth devise?

guides one deactivate rails.application.config.session_store understanding not allow rails keep track of csrf tokens causes rails lose track of sessionsg. after attempting many solutions including:

1. require jquery_ujs on rails manifesto.
2. rails.application.config.session_store :disabled.
3. https://github.com/abuiles/rails-csrf.
4. changing ember.js adapter append csrf.

the end result still pretty same:

can't verify csrf token authenticity followed completed 422 unprocessable entity if protect_from_forgery set :exception instead of :null_session.

example transaction:

partial request header:

x-csrf-token:1vgiz6mfv4kdj0yygfidq54dv2rjeiaq57o05psdndlaqsxmzegdqioesyawg1bz+dg7oi6i2xxababsowqbrq== 

responder header

   http/1.1 422 unprocessable entity    content-type: text/plain; charset=utf-8    x-request-id: 71e94632-ad98-4b3f-97fb-e274a2ec1c7e    x-runtime: 0.050747    content-length: 74162    response attaches following:   session dump   _csrf_token: "jfjdzkn/kodnnjm0dxlutmssemidqxj7u/hrgmsd3de=" 

the rails-csrf response csrf branch (branch has been deleted).

beforemodel() {     return this.csrf.fetchtoken(); },  partial dump of return statement:  _result: object param: "authenticity_token" token: "1vgiz6mfv4kdj0yygfidq54dv2rjeiaq57o05psdndlaqsxmzegdqioesyawg1bz+dg7oi6i2xxababsowqbrq==" 

from understanding, of these attempted solutions have common root: session_store disabled...

update!

the answer below turned out wrong in nature after learning more csrf protection , ember-cli-rails.

---

the idea here have 2 storages: cookie-based storage csrf token maintained rails, , localstorage maintained ember-simple-auth user authenticity token, email , id being taken care of while custom session sessionaccount inherits values , validates them against server before setting user available entire ember.js.

the validation sessionaccount occurs in order detect tampering localstorage. validation occurs every time sessionaccount queries localstorage (e.g page reload) communicates server through token model (token, email , id.) server responds 200 or 404 through tokenserializer renders email or validation error, not disclosing frontend see other authentication_tokens unless user sign in through login form requires email , password.

from understanding, weak spots in methodology not susceptible enough hackable unless:

• someone invades server , database content. although passwords salted, person has database dump can change localstorage token, email , id person want impersonate , server validation work. however, can minimized worker changes authentication token non-logged in users every 24 hours (or other timeframe.) code example section not have worker since still have not learned them.
• someone know password , email of person want hack... not can 1 @ moment.
• someone intercept data being passed around through json api. strong ssl implementation should job.
• if sessionaccount has in lines of is_admin, token sent alongside post request admin requests in order further backend validation since can never trust frontend.
• something else? ones aware of.

now onto practical approach:

1. set rails.application.config.session_store :csrf_cookie_store, key: '_xxxxx_id', httponly: false on session_store.db.
2. create csrf_cookie_store under lib , require on application.rb require 'csrf_cookie_store'.
3. set protect_from_forgery with: :exception on application.rb.
4. create tokencontroller handle validation.
5. tokenserializer email sent back.
6. update devise session controller change token upon login , skip authenticity token validation on session destroy.
7. check routes tokens create , have custom devise session.
8. create ember.js token model
9. match sessionaccount created.
10. update devise authenticator send delete request server when session being invalidated.
11. test out.