search

socialcast / devise_oauth2_providable

Rails3 engine integrating OAuth2 authentication with Devise
MIT License
219 stars 102 forks source link

[Security] Support for the :state parameter required with omniauth-oauth2 v1.1 #43

Open ZenCocoon opened 12 years ago

ZenCocoon commented 12 years ago

Hi,

A few days ago, a security update has been made to omniauth-oauth2, this one uses the :state parameter to mitigate CSRF. https://github.com/intridea/omniauth-oauth2/pull/18

However, it seem that devise_oauth2_providable doesn't handle this parameter as expected as it doesn't send it back in the callback.

A similar issue seems to be faced at https://github.com/intridea/omniauth-oauth2/issues/20

adampope commented 12 years ago

+1 to this. Would love to see a fix.

karlfreeman commented 12 years ago

:+1:

ZenCocoon commented 12 years ago

Anyone having time to make a pull request?