Fix rescuing of application errors when call_app! is used.
As a consequence of the changes that were merged in #689, errors
thrown by strategies that utilize other_phase (or more specifically
call_app!), would be caught by omniauth, causing headaches for folks
looking to have those errors handled by their application. This
should allow for errors that come from the app to pass through, while
passing errors that come from the authentication phases to the fail!
handler.
Fix for incorrect order of request_validation_phase in test_mode.
@jsdalton gave an awesome report of the issue present in test_mode in #1033
The current implementation of mock_call was verifying the token for all requests, regardless of whether the current path is on the omniauth request path. The change was introduced recently in 1b784ff. See #1032 for details.
This creates two problems:
When test mode is on, the authenticity verification logic is run inappropriately against requests where this may not even be wanted.
The behavior varies from actual production behavior, potentially allowing bugs to be introduced by unwary developers.
Note that this bug was only present when OmniAuth was configured for test_mode and using the mock_call phases.
Allow passing rack-protection configuration to default request_validation_phase
This release now properly allows an instance of OmniAuth::AuthenticityTokenProtection (with passed in rack-protection configuration) to be used as the request_validation_phase.
You can trigger a rebase of this PR by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/pulibrary/lib_jobs/network/alerts).
Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.
Bumps the bundler group group with 2 updates: omniauth and omniauth-cas.
Updates
omniauth
from 1.9.2 to 2.1.2Release notes
Sourced from omniauth's releases.
... (truncated)
Commits
36f46c4
Prep for next releasea13cd11
Merge pull request #1122 from nschonni/jruby-hacka0b31ec
fix: conditional delegate require Rack/JRuby79d0c9a
Merge pull request #1118 from nschonni/remove-old-conditionsc160e48
Merge pull request #1102 from madogiwa0124/update-tesed-ruby-versionsb6cc0cc
chore: Remove conditions for old (J)Rubyc6e01a6
Merge pull request #1110 from nschonni/dependabot-setup4e9563f
ci: update coverals to v2fa2674c
ci: update actions/checkout to v3d050031
chore: add Dependabot for version updatesUpdates
omniauth-cas
from 2.0.0 to 3.0.0Release notes
Sourced from omniauth-cas's releases.
Changelog
Sourced from omniauth-cas's changelog.
Commits
a8bd9b2
Merge pull request #86 from dlindahl/release/v3.0.00553de7
Update changelog and version5f7f7fb
Merge pull request #85 from dlindahl/chore/fix-some-offensesfa932f9
Fix some offenses6ebadfd
Improve Readmec47a0e9
Merge pull request #84 from dlindahl/chore/release-3-beta24f16d8
Set version and changelog to 3.0.0.beta.19d9d3a9
Merge pull request #82 from dlindahl/feature/omniauth-2435573c
Add OmniAuth v2 support4c25eed
Merge pull request #81 from dlindahl/feature/honor-skip-infoUpdates
omniauth-cas
from 2.0.0 to 3.0.0Release notes
Sourced from omniauth-cas's releases.
Changelog
Sourced from omniauth-cas's changelog.
Commits
a8bd9b2
Merge pull request #86 from dlindahl/release/v3.0.00553de7
Update changelog and version5f7f7fb
Merge pull request #85 from dlindahl/chore/fix-some-offensesfa932f9
Fix some offenses6ebadfd
Improve Readmec47a0e9
Merge pull request #84 from dlindahl/chore/release-3-beta24f16d8
Set version and changelog to 3.0.0.beta.19d9d3a9
Merge pull request #82 from dlindahl/feature/omniauth-2435573c
Add OmniAuth v2 support4c25eed
Merge pull request #81 from dlindahl/feature/honor-skip-infoYou can trigger a rebase of this PR by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show