csrf_detected | CSRF detected

[lanrion]

Hi, I come across an issue:

localhost:4000 is oauth2 proiver, a new project, rails 4.1.4 Discorse run on the port: 3000, the master branch

• Exception:

OmniAuth::Strategies::OAuth2::CallbackError at /auth/doorkeeper/callback
csrf_detected | CSRF detected

• settings.yml

# these are global settings
title: doorkeeper log in
message: Log in via doorkeeper (make sure your browser does not block popups)
frame_width: 920
frame_height: 800

# enviornment specific settings:
environments:
  development:
    endpoint: http://localhost:4000 
    key: 0b6865a300616a54c623acc6437a6a07a680f670f85188ea3949bc4885cc6dde
    secret: 206174ce78ecabb7a732bb1904876014a2d612150abde0e215cd7897d77813ef

When I click the "Authorize" button, it raise the exception:

OmniAuth::Strategies::OAuth2::CallbackError at /auth/doorkeeper/callback
csrf_detected | CSRF detected

Thanks.

[acidtib]

Yep having same issue here.

Started GET "/auth/doorkeeper/callback?code=xxxxxxxxxxxxxxxxxxxxxxx" for xx.xxx.xx.xxx at 2014-07-22 17:45:15 +0000
Started GET "/auth/failure?message=csrf_detected&strategy=doorkeeper" for xx.xxx.xx.xxx at 2014-07-22 17:45:15 +0000
Processing by Users::OmniauthCallbacksController#failure as HTML
  Parameters: {"message"=>"csrf_detected", "strategy"=>"doorkeeper"}

[ryancheung]

Having the same issue too. Any solution?

[spaghetticode]

I have just created 2 apps from scratch following the readme, one with doorkeeper as sso server, the other from the current version of discourse on github and had no issue (except for the doorkeeper_for error which is now fixed on the readme). I am thinking your issues depend on your specific app configuration. Can you provide further details?

[ryancheung]

This issue is caused by the default csrf detection for content type text/javascript. I solved this by skipping verify_authenticity_token on devise registration controller:

diff --git a/app/controllers/registrations_controller.rb b/app/controllers/registrations_controller.rb
index caa9030..64edfa7 100644
--- a/app/controllers/registrations_controller.rb
+++ b/app/controllers/registrations_controller.rb
@@ -1,3 +1,4 @@
 class RegistrationsController < Devise::RegistrationsController
   respond_to :html, :js
+  skip_before_filter :verify_authenticity_token, :if => Proc.new { |c| puts c.request.format; c.request.format == 'text/javascript' }
 end