ruby - "CSRF detected" with Omniauth and Google -


i'm getting this

omniauth::strategies::oauth2::callbackerror @ /auth/google/callback csrf_detected | csrf detected

my code:

require 'sinatra' require "sinatra/json" require "sinatra/config_file" require 'omniauth-oauth2' require 'omniauth-google-oauth2'  use rack::logger  config_file "config/app_config.yml" use rack::session::cookie, secret: '5fb7w345y3489f523y4h'  configure   enable :sessions end  use omniauth::builder   provider :google_oauth2, settings.google[:client_id], settings.google[:secret],     {       :scope => "userinfo.profile",       :access_type => "offline",       :prompt => "select_account consent",       :name => "google"     } end  '/list'   json get_list end  '/'   %q|<a href='/auth/google'>sign in google</a>| end  '/auth/:name/callback'   @auth = request.env['omniauth.auth']   @auth.inspect end

my callback returning both code , state.

got same problem

(google_oauth2) callback phase initiated.
(google_oauth2) authentication failure! csrf_detected: omniauth::strategies::oauth2::callbackerror, csrf_detected | csrf detected

last omniauth-oauth2 update introduced "state" param has mandatory field.

some people suggest using provider_ignores_state: true it's bad idea because introduces csrf flaw

guess we'll have downgrade previous version keep google_oauth2 working.

issue on https://github.com/intridea/omniauth-oauth2/issues/58


Comments

Post a Comment

Popular posts from this blog

get url and add instance to a model with prefilled foreign key :django admin -

Image
i have page in each contest shown in row. each row contains contest id , link other model names have foreign key contest. news model: class news(models.model): title = models.charfield(max_length=50, null=true) description = models.textfield() time = models.timefield( default= datetime.datetime.now().time()) contest = models.foreignkey(contest) i want use admin adding , changing these models. want when user clicks on 'news' has foreign key contest id=1, shows list of news value foreign key. use {% instance in instances %} <tr class="{% cycle 'row1' 'row2' %}"> <td>{{ instance.title }}</td> <td>{{ instance.starttime }}</td> <td>{{ instance.timespan }}</td> <td>{{ instance.date }}</td> <td><a href="/adm...
Read more

android - Keyboard hides my half of edit-text and button below it even in scroll view -

i having trouble keyboard covers edit-text , half of button in scroll view. here's layout , please tell me how should resolve problem. many questions on topic none of them s working me. <?xml version="1.0" encoding="utf-8"?> <linearlayout xmlns:android="http://schemas.android.com/apk/res/android" android:layout_width="match_parent" android:background="@drawable/bg" android:layout_height="match_parent"> <scrollview android:layout_width="match_parent" android:fillviewport="true" android:layout_height="match_parent"> <relativelayout android:layout_width="match_parent" android:layout_height="wrap_content" android:orientation="vertical"> <linearlayout android:layout_width="match_parent" android:layout_height="w...
Read more

css - Make div keyboard-scrollable in jQuery Mobile? -

from can tell, although jquery-mobile-powered pages can contain divs overflow set scroll or auto, , these divs can scrolled one-screen bar or mouse wheel, cannot scrolled using arrow keys, page-up/page-down, or home/end. instead, official "page" div (with data-role="page") absorbs input. perhaps other divs can't acquire focus, i'm not sure. is there way around this? edit: jsfiddle of simple example: https://jsfiddle.net/qogz0shx/ <script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js"></script> <script src="https://ajax.googleapis.com/ajax/libs/jquerymobile/1.4.5/jquery.mobile.min.js"> </script> <link rel="stylesheet" href="https://code.jquery.com/mobile/1.4.5/jquery.mobile-1.4.5.css"/> <style> #outer { overflow:scroll; height: 50vh; width: 50vw; } #inner { height: 500vh; width: 500vw; } ...
Read more