Fix ActionCable::Connection::Authorization::UnauthorizedError: An unauthorized connection attempt was rejected in Rails

This error occurs when ActionCable rejects a WebSocket connection because the connect method in your connection class calls reject_unauthorized_connection. This typically means the user is not authenticated or the session cookie is not being sent with the WebSocket handshake. Verify your authentication logic in ApplicationCable::Connection.

Reading the Stack Trace

Here's what each line means:

• app/channels/application_cable/connection.rb:8:in `connect': Your connection.rb connect method calls reject_unauthorized_connection because the user lookup failed.
• actioncable (7.1.3) lib/action_cable/connection/authorization.rb:14:in `reject_unauthorized_connection': ActionCable rejects the WebSocket upgrade request and closes the connection.
• actioncable (7.1.3) lib/action_cable/connection/base.rb:65:in `process': The connection processing pipeline where authentication is checked during the WebSocket handshake.

Common Causes

# app/channels/application_cable/connection.rb
module ApplicationCable
  class Connection < ActionCable::Connection::Base
    identified_by :current_user

    def connect
      self.current_user = find_verified_user
    end

    def find_verified_user
      user = User.find_by(id: cookies.encrypted[:user_id])
      user || reject_unauthorized_connection
    end
  end
end

# config/environments/production.rb
config.action_cable.allowed_request_origins = ['https://myapp.com']
# But frontend is on https://app.myapp.com

# config/cable.yml
production:
  adapter: async  # Should be redis for multi-server setups

The Fix

Add a fallback authentication method using a token parameter for cases where cookies are not available. This handles cross-origin WebSocket connections where session cookies may not be sent.

module ApplicationCable
  class Connection < ActionCable::Connection::Base
    identified_by :current_user

    def connect
      self.current_user = find_verified_user
    end

    def find_verified_user
      user = User.find_by(id: cookies.encrypted[:user_id])
      user || reject_unauthorized_connection
    end
  end
end

module ApplicationCable
  class Connection < ActionCable::Connection::Base
    identified_by :current_user

    def connect
      self.current_user = find_verified_user
    end

    def find_verified_user
      if (user = User.find_by(id: cookies.encrypted[:user_id]))
        user
      elsif (user = authenticate_with_token)
        user
      else
        reject_unauthorized_connection
      end
    end

    def authenticate_with_token
      token = request.params[:token]
      User.find_by(auth_token: token) if token.present?
    end
  end
end

Testing the Fix

require 'rails_helper'

RSpec.describe ApplicationCable::Connection, type: :channel do
  let(:user) { create(:user) }

  it 'connects with valid cookie' do
    cookies.encrypted[:user_id] = user.id
    connect '/cable'
    expect(connection.current_user).to eq(user)
  end

  it 'connects with valid token' do
    user.update!(auth_token: 'valid_token')
    connect '/cable?token=valid_token'
    expect(connection.current_user).to eq(user)
  end

  it 'rejects unauthorized connections' do
    expect { connect '/cable' }.to have_rejected_connection
  end
end

Run your tests:

bundle exec rspec spec/channels/connection_spec.rb

Pushing Through CI/CD

git checkout -b fix/rails-action-cable-auth,git add app/channels/application_cable/connection.rb,git commit -m "fix: add token-based fallback auth for ActionCable connections",git push origin fix/rails-action-cable-auth

Your CI config should look something like this:

name: CI
on:
  pull_request:
    branches: [main]
jobs:
  test:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_PASSWORD: postgres
        ports: ['5432:5432']
      redis:
        image: redis:7
        ports: ['6379:6379']
    steps:
      - uses: actions/checkout@v4
      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.3'
          bundler-cache: true
      - run: bin/rails db:setup
      - run: bundle exec rspec

The Full Manual Process: 18 Steps

Here's every step you just went through to fix this one bug:

1. Notice the error alert or see it in your monitoring tool
2. Open the error dashboard and read the stack trace
3. Identify the file and line number from the stack trace
4. Open your IDE and navigate to the file
5. Read the surrounding code to understand context
6. Reproduce the error locally
7. Identify the root cause
8. Write the fix
9. Run the test suite locally
10. Fix any failing tests
11. Write new tests covering the edge case
12. Run the full test suite again
13. Create a new git branch
14. Commit and push your changes
15. Open a pull request
16. Wait for code review
17. Merge and deploy to production
18. Monitor production to confirm the error is resolved

Total time: 30-60 minutes. For one bug.

gem install bugstack

require 'bugstack'

Bugstack.init(api_key: ENV['BUGSTACK_API_KEY'])

Deploying the Fix (Manual Path)

1. Update the connection authentication logic.
2. Add channel specs for all authentication paths.
3. Configure allowed_request_origins for your domains.
4. Open a pull request.
5. Merge and verify WebSocket connections work in staging.

Frequently Asked Questions