search

swelham / ueberauth_microsoft

Microsoft Strategy for Überauth
MIT License
37 stars 35 forks source link

CSRF not implemented #29

Closed Awlexus closed 3 years ago

Awlexus commented 3 years ago

https://github.com/swelham/ueberauth_microsoft/pull/25 updated the ueberauth to version 0.7, which requires strategies to prevent CSRF attacks.

Because the library was simply updated, and no protection added, every attempt to sign in results in an error. I would therefore recommend retiring the version 0.11.0.

swelham commented 3 years ago

Thanks for reporting. I totally missed that and will retire 0.11.0.

swelham commented 3 years ago

Now retired and release 0.12.0 has been published with a rollback to ueberauth 0.6 until the feature can be implemented.