search

mtchavez / ueberauth_gitlab

Gitlab OAuth2 Strategy fo Überauth
Other
7 stars 7 forks source link

Add support for Uberauth CSRF protection #113

Closed pst closed 2 years ago

pst commented 2 years ago

Following: https://github.com/ueberauth/ueberauth_github/pull/63

PJUllrich commented 2 years ago

I just ran into the problem this PR is solving and unfortunately I believe that the library is "broken" until it is merged. The request to GitLab contains no state parameter and Ueberauth blocks the callback because the non-existent state parameter does not match the ubereauth.state_param-cookie. I believe you can add the state-parameter by removing the plug Ueberauth from AuthController and setting the parameter manually in request/2. But this requires hard-coding the cookie name ueberauth.state_param.

@mtchavez Please consider merging this soon. It would be much appreciated :)

mtchavez commented 2 years ago

Released version 0.4.0 with the changes.

PJUllrich commented 2 years ago

Thank you very much for the super quick response! :)