search

omniauth / omniauth_openid_connect

MIT License
170 stars 187 forks source link

Upgrade omniauth to 2.0 #84

Closed manuelvanrijn closed 3 years ago

manuelvanrijn commented 3 years ago

Because I was getting the CVE-2015-9284 because the version of omniauth was too low, I've upgraded it to a newer version.

This should fix #81.

The only change I also had to add was the following, to have the GET /auth/:provider to work

OmniAuth.config.allowed_request_methods = [:get, :post]
travisofthenorth commented 3 years ago

@m0n9oose any help with the failures here?

jonspalmer commented 3 years ago

It would be terrific to get this change merged and a new release. The CVE issue is becoming a pain point.

stale[bot] commented 3 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

jonspalmer commented 3 years ago

We really need this PR to me merge to mitigate the CVE. Can we get some attention on this?