LockError in DeviseTokenAuth::TokenValidationsController#validate_token and authentication cookies problems :(

Nobody has claimed this yet.

Hello,

I'm having problems when trying to fetch resources after login, and to validate_token. After the login, sometimes the first request to validate_token is successful, but sometimes it's not. And all the resources of mine that has "before_action :authenticate_user!" fails the second time. Basically what I see is that after a little time the token is blank inside set_user_by_token gem method. But token.client and all the rest is ok.

But what is intriguing me the most is this error that sometimes happens in validate_token:
```
Mongoid::Locker::LockError in DeviseTokenAuth::TokenValidationsController#validate_token
```
```
# Error happens inside refresh_headers, after @resource.with_lock
# and breaks inside Mongoid::Locker, in the following part:

raise LockError, 'could not get lock' unless attempts_left > 0

```

I'm using the master version of this gem (devise_token_auth), because when I don't, it doesn't accept my config.cookie_enabled = true config, it says it doesn't exist, even though it is in the documentation.

My front-end is ReactJs, and I use react-query and axios to fetch resources, and I have the withCredentials: true configuration on it.

Validate Token Request Headers

```
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate, br
Accept-Language: pt-BR,pt;q=0.9,en-US;q=0.8,en;q=0.7
Connection: keep-alive
Cookie: _ga=GA1.1.873298443.1619707136; __profilin=p%3Dt; _session_id=LfRjDHP%2B5S%2BvIZdlSfYLra5NRTYNQwHwXjT0Gjm9aVI3fdFMU7MXj7ni3XZjCioSny%2Fl21pdXLCawUXMiuK1AM0y%2FVdLjDJmzJT3uFJd40HF5qLGkRdyYqqULD77NilhzYkMSZCYsg7wVh51lX78X64ggBts525P8yA%2FklsvAzGiALuA39zNlqGAb4g54b0pi%2F7uJydSo8J0XqLzK7pJXAijKB0BUKlYlbZgi3cTBpOjCKEF43wAuc%2FeuMFndv0QsVIqBvsYOdyXKKoiskZPhuhCCI%2Fj9vsy2cHhTFpWsOv7USBMb2cwlnYMOav%2Fo5ATafZ8--81%2Fih9G8HFuQrsYZ--%2FRXeEi9pmK3CFmpZ93DyWg%3D%3D; _show-app-api=gYtr9sKV86V2HwWwcfI8dAH%2BViypmwYNXvn5QNf0uzwXCHzNzKJN%2FNI%2BcVcjj9drl0fxpOro8DtHa4cXrOl51m0GctxlNK0vx2olgCNrB1Euogavm3%2Fh6Dq77Xks7TAX11SCfx2zopC35%2FFy%2F0I1ZJG9zawBCN1RvEDrsOLWxK5e8Pu1ZTUycFocYqhIH27MsD5NkBP7nZDjgztcGmL3gAPidKCUdDaKJ4n9VrpQCF75oDf%2FlUz9%2B%2F6MJIQT5z2A3d2OP3Ik0pzZjsnd9MBSb8DTs548WnODMilJCMOVNSObNrB1ZkYHoBG59qc7nZ81HNcSIO8%3D--zn9%2FKdBPnAWn0eIT--a50SFiUfxCHsECnSG4KvAw%3D%3D; auth=%7B%22access-token%22%3A%220hebmBliZektyyxckLV6PA%22%2C%22token-type%22%3A%22Bearer%22%2C%22client%22%3A%22T4Z7Kao7afYgPJjomqW3CQ%22%2C%22expiry%22%3A%221622606503%22%2C%22uid%22%3A%22teste%40hotmail.com%22%7D; _show_app_api_session=xuZSEeaoTiggrLp6BK5j7v%2F8Qj%2FhqyU6TGl%2Bh5GOXLGK3CLmAMKmYT9oouuYFaCn7SUJJK7stt5T5UGT2kw51yersJ57iniDOKIlwp7YozfJj8C8qnqMASQzh7wZWYc9D0Zkt9ldlWEDNwANJc53MtoSBhnpIRhiI0loB64GtF7U8B3y4G2eMye%2F%2Fki7zFfIqHlDaLc%2F9K9y96KNb%2FF0EwaG5padJjOry3KTu8Ww4kFvJC91EIdgMkllyP29690NQKm%2FYVmq%2BHuIV8jaKNu1wz6PswV3bL%2FgR5CH95yYn2J3Ul8sDKxsUSvfoBwTWqECVMLl%2BvvJR1dYCu2v0Q%3D%3D--HnR%2B7pLi1P4zR6Wy--z0VT5NPLgvT5zS6HmhoxTg%3D%3D
Host: localhost:3001
Origin: http://localhost:3000
Referer: http://localhost:3000/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36

```

Some previous headers

```
# Sign In Request Header:

Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate, br
Accept-Language: pt-BR,pt;q=0.9,en-US;q=0.8,en;q=0.7
Connection: keep-alive
Content-Length: 51
Content-Type: application/json;charset=UTF-8
Cookie: _ga=GA1.1.873298443.1619707136; __profilin=p%3Dt; _session_id=LfRjDHP%2B5S%2BvIZdlSfYLra5NRTYNQwHwXjT0Gjm9aVI3fdFMU7MXj7ni3XZjCioSny%2Fl21pdXLCawUXMiuK1AM0y%2FVdLjDJmzJT3uFJd40HF5qLGkRdyYqqULD77NilhzYkMSZCYsg7wVh51lX78X64ggBts525P8yA%2FklsvAzGiALuA39zNlqGAb4g54b0pi%2F7uJydSo8J0XqLzK7pJXAijKB0BUKlYlbZgi3cTBpOjCKEF43wAuc%2FeuMFndv0QsVIqBvsYOdyXKKoiskZPhuhCCI%2Fj9vsy2cHhTFpWsOv7USBMb2cwlnYMOav%2Fo5ATafZ8--81%2Fih9G8HFuQrsYZ--%2FRXeEi9pmK3CFmpZ93DyWg%3D%3D; auth=%7B%22access-token%22%3A%22+%22%2C%22token-type%22%3A%22Bearer%22%2C%22client%22%3A%22stBVB4yUd6_W2I3j6cBB6w%22%2C%22expiry%22%3A%22+%22%2C%22uid%22%3A%22teste%40hotmail.com%22%7D; _show-app-api=gYtr9sKV86V2HwWwcfI8dAH%2BViypmwYNXvn5QNf0uzwXCHzNzKJN%2FNI%2BcVcjj9drl0fxpOro8DtHa4cXrOl51m0GctxlNK0vx2olgCNrB1Euogavm3%2Fh6Dq77Xks7TAX11SCfx2zopC35%2FFy%2F0I1ZJG9zawBCN1RvEDrsOLWxK5e8Pu1ZTUycFocYqhIH27MsD5NkBP7nZDjgztcGmL3gAPidKCUdDaKJ4n9VrpQCF75oDf%2FlUz9%2B%2F6MJIQT5z2A3d2OP3Ik0pzZjsnd9MBSb8DTs548WnODMilJCMOVNSObNrB1ZkYHoBG59qc7nZ81HNcSIO8%3D--zn9%2FKdBPnAWn0eIT--a50SFiUfxCHsECnSG4KvAw%3D%3D; _show_app_api_session=krXBvDg5Z7%2B3sAYRMXkwCaD1PEK86zO4SCBR6earT3OAFOPC%2Fhqngywrwbliu5BZ5oIR7CC18C3p4UyEe3yJ%2BF%2B0GhUyzrKeQvaOsqKbMX%2BfZjDL%2FgzC%2Fp7jjVuDNqZCbsnVVXGLs1MA%2FgJfikZ%2FC%2Bi6vXOfUdQ3yxQ%2BYte1ILEprTbymShQW%2BOmoNdRWe3y1qkd0r8s3E1BJtgF68DTdAZwf46HRxbvWVg3oq7WhZwd4HbUz%2BgaP9sjHzPgTImaJnzn1wCcePUWG5UiResTxYSq7NZibEu8GtoA5%2FZCQ9x96x%2B0Q6RpfYTeczHR8jPXHRv12Zyi6EFDQWgAYg%3D%3D--fnnpWP7eBqStJbS%2F--9E5J4FD4xMwMdpAQAPzF0w%3D%3D
Host: localhost:3001
Origin: http://localhost:3000
Referer: http://localhost:3000/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36

# Shows Most Favorited resource request header:

Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate, br
Accept-Language: pt-BR,pt;q=0.9,en-US;q=0.8,en;q=0.7
Connection: keep-alive
Cookie: _ga=GA1.1.873298443.1619707136; __profilin=p%3Dt; _session_id=LfRjDHP%2B5S%2BvIZdlSfYLra5NRTYNQwHwXjT0Gjm9aVI3fdFMU7MXj7ni3XZjCioSny%2Fl21pdXLCawUXMiuK1AM0y%2FVdLjDJmzJT3uFJd40HF5qLGkRdyYqqULD77NilhzYkMSZCYsg7wVh51lX78X64ggBts525P8yA%2FklsvAzGiALuA39zNlqGAb4g54b0pi%2F7uJydSo8J0XqLzK7pJXAijKB0BUKlYlbZgi3cTBpOjCKEF43wAuc%2FeuMFndv0QsVIqBvsYOdyXKKoiskZPhuhCCI%2Fj9vsy2cHhTFpWsOv7USBMb2cwlnYMOav%2Fo5ATafZ8--81%2Fih9G8HFuQrsYZ--%2FRXeEi9pmK3CFmpZ93DyWg%3D%3D; _show-app-api=gYtr9sKV86V2HwWwcfI8dAH%2BViypmwYNXvn5QNf0uzwXCHzNzKJN%2FNI%2BcVcjj9drl0fxpOro8DtHa4cXrOl51m0GctxlNK0vx2olgCNrB1Euogavm3%2Fh6Dq77Xks7TAX11SCfx2zopC35%2FFy%2F0I1ZJG9zawBCN1RvEDrsOLWxK5e8Pu1ZTUycFocYqhIH27MsD5NkBP7nZDjgztcGmL3gAPidKCUdDaKJ4n9VrpQCF75oDf%2FlUz9%2B%2F6MJIQT5z2A3d2OP3Ik0pzZjsnd9MBSb8DTs548WnODMilJCMOVNSObNrB1ZkYHoBG59qc7nZ81HNcSIO8%3D--zn9%2FKdBPnAWn0eIT--a50SFiUfxCHsECnSG4KvAw%3D%3D; auth=%7B%22access-token%22%3A%220hebmBliZektyyxckLV6PA%22%2C%22token-type%22%3A%22Bearer%22%2C%22client%22%3A%22T4Z7Kao7afYgPJjomqW3CQ%22%2C%22expiry%22%3A%221622606503%22%2C%22uid%22%3A%22teste%40hotmail.com%22%7D; _show_app_api_session=xuZSEeaoTiggrLp6BK5j7v%2F8Qj%2FhqyU6TGl%2Bh5GOXLGK3CLmAMKmYT9oouuYFaCn7SUJJK7stt5T5UGT2kw51yersJ57iniDOKIlwp7YozfJj8C8qnqMASQzh7wZWYc9D0Zkt9ldlWEDNwANJc53MtoSBhnpIRhiI0loB64GtF7U8B3y4G2eMye%2F%2Fki7zFfIqHlDaLc%2F9K9y96KNb%2FF0EwaG5padJjOry3KTu8Ww4kFvJC91EIdgMkllyP29690NQKm%2FYVmq%2BHuIV8jaKNu1wz6PswV3bL%2FgR5CH95yYn2J3Ul8sDKxsUSvfoBwTWqECVMLl%2BvvJR1dYCu2v0Q%3D%3D--HnR%2B7pLi1P4zR6Wy--z0VT5NPLgvT5zS6HmhoxTg%3D%3D
Host: localhost:3001
Origin: http://localhost:3000
Referer: http://localhost:3000/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36

# Show most favorited resource sucessfull request headers response
# before the validate_token unsucessfull response:

Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD
Access-Control-Allow-Origin: http://localhost:3000
Access-Control-Expose-Headers: access-token, expiry, token-type, uid, client
Access-Control-Max-Age: 7200
access-token
Cache-Control: no-store, must-revalidate, private, max-age=0
client: T4Z7Kao7afYgPJjomqW3CQ
Content-Type: application/json; charset=utf-8
expiry
Referrer-Policy: strict-origin-when-cross-origin
Set-Cookie: auth=%7B%22access-token%22%3A%22+%22%2C%22token-type%22%3A%22Bearer%22%2C%22client%22%3A%22T4Z7Kao7afYgPJjomqW3CQ%22%2C%22expiry%22%3A%22+%22%2C%22uid%22%3A%22teste%40hotmail.com%22%7D; path=/; HttpOnly; SameSite=Lax
Set-Cookie: _show_app_api_session=WUOl2N0oe%2BBTMA9bfv77ImskmtBpScL71Lfj3Bl5%2B1H8yttHBb62QoMHjh6zOuPn6yB1j96Ir9svw97zntKQjaww957JMl1XbRQi4OYsWq4Mgwt9GIpEwYqcdgMa0pvhChML3Zqc%2FiH%2Bs8rKQJw7KcU%2Bute0CyRDeEaUPbkrQMYPM8Lx7NpKU6594S28MRHdX04TIP99ztaXZ8WQeaT4qhWRboYqTns5PePrMXZLuGKDywNuXCn6QGdoaRRtMbjmJcK9HBHbjT4a3VbUU4584E4tgDRhb9zvqtz9jD%2FkK4zwOvJmpQG9OYCg5fpFWzxQTNm8ExwPAVHq2Uu0gQ%3D%3D--DbtWEB2aqXXFuWLY--taw0oFKXIXBkg9N1EK6gBg%3D%3D; path=/; HttpOnly; SameSite=Lax
Set-Cookie: __profilin=p%3Dt; path=/; HttpOnly; SameSite=Lax
token-type: Bearer
Transfer-Encoding: chunked
uid: teste@hotmail.com
Vary: Origin
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-MiniProfiler-Ids: q7737ivvlss2jz4s1kis,ky4n54zslev3b3u7d5l2,669m65b4wwoa7zxxrhm1,mpxdk5phvch9gzdse0a8,qs7sxt3uho1qp9u3s94k,e02waxeuh3l84gsyxjgf,8dg01m8s1hwk41rf9npr,27ypyux2hgc4oksydale,v2vm06fptqwm4t2wifln,vy2228b1wtjjrrsyu7ph,hirz647n6egc41yvc6gy,f762wyp11ua6p7xf9gnq,c0qrm8dbwukahs1689el,47ejnrksefg675nr60qt,asdslh8g4rsjus1vaibu,1u1ukg35gnlc252tbv6o,tcgv0k0gh9jngi8ulj03,183s0sox57oz2f7zdtu3,3szsihw17lxxrgrnf2f3,rnp3qwnzqgayxgujz181
X-MiniProfiler-Original-Cache-Control: max-age=0, private, must-revalidate
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: cab1217b-c4e7-4269-91ca-f85eb6a2a434
X-Runtime: 8.707535
X-XSS-Protection: 1; mode=block
```

Config file => devise_token_auth.rb

```
DeviseTokenAuth.setup do |config|
config.cookie_enabled = true
config.cookie_name = 'auth'
config.cookie_attributes = { httponly: true }

config.token_lifespan = 1.week
config.batch_request_buffer_throttle = 30.seconds

config.token_cost = Rails.env.test? ? 4 : 10
end

```

Routes => routes.rb

```
Rails.application.routes.draw do
mount_devise_token_auth_for 'User', at: 'api/v1/auth'
namespace :api do
namespace :v1 do
resources :shows, only: [:index]
end
end
end
```

User model file

```
class User
include Mongoid::Document
include Mongoid::Timestamps
include Mongoid::Locker

field :email, type: String
field :encrypted_password, type: String

field :locker_locked_at, type: Time
field :locker_locked_until, type: Time

locker locked_at_field: :locker_locked_at,
locked_until_field: :locker_locked_until

## Required
field :provider, type: String
field :uid, type: String, default: ''

## Tokens
field :tokens, type: Hash, default: {}

field :nickname, type: String
field :full_name, type: String

devise :database_authenticatable, :registerable,
:recoverable, :rememberable, :validatable
include DeviseTokenAuth::Concerns::User

index({ uid: 1, provider: 1}, { name: 'uid_provider_index', unique: true, background: true })
end
```

Application Controller

```
class ApplicationController < ActionController::Base
skip_before_action :verify_authenticity_token
include DeviseTokenAuth::Concerns::SetUserByToken
end
```

Gemfile

```
source 'https://rubygems.org'
git_source(:github) { |repo| "https://github.com/#{repo}.git" }

ruby '2.6.6'

gem 'rails', '~> 6.1.3', '>= 6.1.3.1'
gem 'puma', '~> 5.0'
gem 'webpacker', '~> 5.0'
gem 'turbolinks', '~> 5'
gem 'jbuilder', '~> 2.7'

gem 'mongoid', '~> 7.2'
gem 'mongoid-history'
gem 'mongoid-locker', '~> 1.0' # If I don't use this version it doesn't even work... :(
gem 'mongoid-paperclip'
gem 'rack-cors'
gem "devise"
gem "bcrypt"
gem 'devise_token_auth', git: 'git@github.com:lynndylanhurley/devise_token_auth.git', branch: 'master'

gem 'bootsnap', '>= 1.4.4', require: false

group :development, :test do
gem 'byebug', platforms: [:mri, :mingw, :x64_mingw]
end

group :development do
gem 'web-console', '>= 4.1.0'
gem 'rack-mini-profiler', '~> 2.0'
gem 'listen', '~> 3.3'
gem 'spring'
end

gem 'tzinfo-data', platforms: [:mingw, :mswin, :x64_mingw, :jruby]
```

My cors.rb rile

```
Rails.application.config.middleware.insert_before 0, Rack::Cors do
allow do
origins 'http://localhost:3000'
resource '*',
headers: :any,
expose: %w[access-token expiry token-type uid client],
methods: %i[get post put patch delete options head],
credentials: true
end
end
```

Trace

```
mongoid-locker (1.0.1) lib/mongoid/locker.rb:180:in `block in lock'
mongoid-locker (1.0.1) lib/mongoid/locker.rb:175:in `loop'
mongoid-locker (1.0.1) lib/mongoid/locker.rb:175:in `lock'
mongoid-locker (1.0.1) lib/mongoid/locker.rb:123:in `with_lock'
/home/gabriel/code/debugferro/show-app/show-app-new/devise_token_auth/app/controllers/devise_token_auth/concerns/set_user_by_token.rb:134:in `refresh_headers'
/home/gabriel/code/debugferro/show-app/show-app-new/devise_token_auth/app/controllers/devise_token_auth/concerns/set_user_by_token.rb:125:in `update_auth_header'
activesupport (6.1.3.2) lib/active_support/callbacks.rb:427:in `block in make_lambda'
activesupport (6.1.3.2) lib/active_support/callbacks.rb:246:in `block in halting'
activesupport (6.1.3.2) lib/active_support/callbacks.rb:516:in `block in invoke_after'
activesupport (6.1.3.2) lib/active_support/callbacks.rb:516:in `each'
activesupport (6.1.3.2) lib/active_support/callbacks.rb:516:in `invoke_after'
activesupport (6.1.3.2) lib/active_support/callbacks.rb:107:in `run_callbacks'
actionpack (6.1.3.2) lib/abstract_controller/callbacks.rb:41:in `process_action'
actionpack (6.1.3.2) lib/action_controller/metal/rescue.rb:22:in `process_action'
actionpack (6.1.3.2) lib/action_controller/metal/instrumentation.rb:34:in `block in process_action'
activesupport (6.1.3.2) lib/active_support/notifications.rb:203:in `block in instrument'
activesupport (6.1.3.2) lib/active_support/notifications/instrumenter.rb:24:in `instrument'
activesupport (6.1.3.2) lib/active_support/notifications.rb:203:in `instrument'
actionpack (6.1.3.2) lib/action_controller/metal/instrumentation.rb:33:in `process_action'
actionpack (6.1.3.2) lib/action_controller/metal/params_wrapper.rb:249:in `process_action'
mongoid (7.3.0) lib/mongoid/railties/controller_runtime.rb:22:in `process_action'
actionpack (6.1.3.2) lib/abstract_controller/base.rb:165:in `process'
actionview (6.1.3.2) lib/action_view/rendering.rb:39:in `process'
actionpack (6.1.3.2) lib/action_controller/metal.rb:190:in `dispatch'
actionpack (6.1.3.2) lib/action_controller/metal.rb:254:in `dispatch'
actionpack (6.1.3.2) lib/action_dispatch/routing/route_set.rb:50:in `dispatch'
actionpack (6.1.3.2) lib/action_dispatch/routing/route_set.rb:33:in `serve'
actionpack (6.1.3.2) lib/action_dispatch/routing/mapper.rb:19:in `block in '
actionpack (6.1.3.2) lib/action_dispatch/routing/mapper.rb:49:in `serve'
actionpack (6.1.3.2) lib/action_dispatch/journey/router.rb:50:in `block in serve'
actionpack (6.1.3.2) lib/action_dispatch/journey/router.rb:32:in `each'
actionpack (6.1.3.2) lib/action_dispatch/journey/router.rb:32:in `serve'
actionpack (6.1.3.2) lib/action_dispatch/routing/route_set.rb:842:in `call'
warden (1.2.9) lib/warden/manager.rb:36:in `block in call'
warden (1.2.9) lib/warden/manager.rb:34:in `catch'
warden (1.2.9) lib/warden/manager.rb:34:in `call'
rack (2.2.3) lib/rack/tempfile_reaper.rb:15:in `call'
rack (2.2.3) lib/rack/etag.rb:27:in `call'
rack (2.2.3) lib/rack/conditional_get.rb:27:in `call'
rack (2.2.3) lib/rack/head.rb:12:in `call'
actionpack (6.1.3.2) lib/action_dispatch/http/permissions_policy.rb:22:in `call'
actionpack (6.1.3.2) lib/action_dispatch/http/content_security_policy.rb:18:in `call'
rack (2.2.3) lib/rack/session/abstract/id.rb:266:in `context'
rack (2.2.3) lib/rack/session/abstract/id.rb:260:in `call'
actionpack (6.1.3.2) lib/action_dispatch/middleware/cookies.rb:689:in `call'
actionpack (6.1.3.2) lib/action_dispatch/middleware/callbacks.rb:27:in `block in call'
activesupport (6.1.3.2) lib/active_support/callbacks.rb:98:in `run_callbacks'
actionpack (6.1.3.2) lib/action_dispatch/middleware/callbacks.rb:26:in `call'
actionpack (6.1.3.2) lib/action_dispatch/middleware/executor.rb:14:in `call'
actionpack (6.1.3.2) lib/action_dispatch/middleware/actionable_exceptions.rb:18:in `call'
actionpack (6.1.3.2) lib/action_dispatch/middleware/debug_exceptions.rb:29:in `call'
web-console (4.1.0) lib/web_console/middleware.rb:132:in `call_app'
web-console (4.1.0) lib/web_console/middleware.rb:28:in `block in call'
web-console (4.1.0) lib/web_console/middleware.rb:17:in `catch'
web-console (4.1.0) lib/web_console/middleware.rb:17:in `call'
actionpack (6.1.3.2) lib/action_dispatch/middleware/show_exceptions.rb:33:in `call'
railties (6.1.3.2) lib/rails/rack/logger.rb:37:in `call_app'
railties (6.1.3.2) lib/rails/rack/logger.rb:26:in `block in call'
activesupport (6.1.3.2) lib/active_support/tagged_logging.rb:99:in `block in tagged'
activesupport (6.1.3.2) lib/active_support/tagged_logging.rb:37:in `tagged'
activesupport (6.1.3.2) lib/active_support/tagged_logging.rb:99:in `tagged'
railties (6.1.3.2) lib/rails/rack/logger.rb:26:in `call'
sprockets-rails (3.2.2) lib/sprockets/rails/quiet_assets.rb:13:in `call'
actionpack (6.1.3.2) lib/action_dispatch/middleware/remote_ip.rb:81:in `call'
actionpack (6.1.3.2) lib/action_dispatch/middleware/request_id.rb:26:in `call'
rack (2.2.3) lib/rack/method_override.rb:24:in `call'
rack (2.2.3) lib/rack/runtime.rb:22:in `call'
activesupport (6.1.3.2) lib/active_support/cache/strategy/local_cache_middleware.rb:29:in `call'
actionpack (6.1.3.2) lib/action_dispatch/middleware/executor.rb:14:in `call'
actionpack (6.1.3.2) lib/action_dispatch/middleware/static.rb:24:in `call'
rack (2.2.3) lib/rack/sendfile.rb:110:in `call'
actionpack (6.1.3.2) lib/action_dispatch/middleware/host_authorization.rb:98:in `call'
rack-mini-profiler (2.3.2) lib/mini_profiler/profiler.rb:384:in `call'
rack-cors (1.1.1) lib/rack/cors.rb:100:in `call'
webpacker (5.4.0) lib/webpacker/dev_server_proxy.rb:25:in `perform_request'
rack-proxy (0.6.5) lib/rack/proxy.rb:57:in `call'
railties (6.1.3.2) lib/rails/engine.rb:539:in `call'
puma (5.3.1) lib/puma/configuration.rb:249:in `call'
puma (5.3.1) lib/puma/request.rb:76:in `block in handle_request'
puma (5.3.1) lib/puma/thread_pool.rb:338:in `with_force_shutdown'
puma (5.3.1) lib/puma/request.rb:75:in `handle_request'
puma (5.3.1) lib/puma/server.rb:437:in `process_client'
puma (5.3.1) lib/puma/thread_pool.rb:145:in `block in spawn_thread'
```

Well, I hope someone can help me detect what I'm doing wrong, or if this is some weird bug.
Thanks for your attention 🌻

Start at DeviseTokenAuth::TokenValidationsController#validate_token and its refresh_headers call, then trace SetUserByToken#set_user_by_token alongside Mongoid::Locker in the User model. Compare the cookie and token headers shown in the report with devise_token_auth.rb, routes.rb, Application Controller, and Gemfile; done means reproducing and explaining both the LockError and blank-token behavior.

Written by the indexing model from the issue text.