search

ueberauth / ueberauth_twitter

Twitter Strategy for Überauth
MIT License
36 stars 38 forks source link

Disable CSRF protection #44

Closed clupprich closed 3 years ago

clupprich commented 3 years ago

While disabling CSRF protection isn't ideal of course, it will make this strategy work again.

yordis commented 3 years ago

@clupprich does Twitter support this? Just curious if we should put some energy into changing the implementation or it is a matter of Twitter not supporting it

clupprich commented 3 years ago

@yordis I can successfully authenticate, yes.

yordis commented 3 years ago

Twitter Oauth2 supports such thing, let's work on adding such support instead.

https://developer.twitter.com/en/docs/twitter-api/oauth2

Screen Shot 2021-07-19 at 1 45 29 PM

clupprich commented 3 years ago

This was really just meant as a quick fix to make this strategy work with the current version of ueberauth. I totally get your point, though. Will see if I can set some time aside over the next couple of days.

clupprich commented 3 years ago

@yordis I think the page you linked to is for a private OAuth2 beta. I believe we need to add the state to the callback URL.

yordis commented 3 years ago

@clupprich ahhh true! damn it!