search

hexgnu / linkedin

Ruby wrapper for the LinkedIn API
http://rdoc.info/gems/linkedin
MIT License
756 stars 407 forks source link

LinkedIn API session issue #260

Open jbayotlang opened 8 years ago

jbayotlang commented 8 years ago

Hi All

Our web app is built around Ruby on Rails 3. We use the linkedin rubygem to integrate the LinkedIn API.

We have successful Linkedin sign-in and registrations, but at rare cases (occurring twice or thrice a year so far), a user logins/registers via LinkedIn but a totally different and unconnected user shows up. (UserA enters LinkedIn credentials for the permissions, but some LinkedIn UserB gets returned). We don't get why this happens at all.

Here is the code snippet for the OAuth url:

client = LinkedIn::Client.new('app_token', 'app_secret', @@config)
request_token = client.request_token(:oauth_callback => "http://#{request.host}:#{request.port}/auth/oauth_account")
session[:rtoken] = request_token.token
session[:rsecret] = request_token.secret
session[:provider_user] = "linkedin"
redirect_to request_token.authorize_url

The bug highly makes it insecure for users. Could someone help?

hexgnu commented 8 years ago

UserA and UserB are in your app?

If so then it seems like a session hijacking issue where the session is getting shared with another user.

Also is your app thread-safe?