omniauth-artsy 0.3.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 288c57c8e47b184a09c410179705501e5c09f4d0594f7278cef990d7842c12f3
-  data.tar.gz: 0acc42b621eb30cc637da2a8a55d002c7739dbbe4ac9cd7d8d9a49b0d2290268
+  metadata.gz: ca82c0fae98546412426c5ac17a13cb3b045d0b32aa215ce363c69cc26bd1987
+  data.tar.gz: 791642de60880e731ec20425552763b8e8eb7b85816d5c438f0dd6e9d92456ad
 SHA512:
-  metadata.gz: 656a8269b399888fbbd912bad9527bd694c0fa14af85e93eecd0cc5cbca6b45b1a738d21e07ccd13239946ab45aa80878318c4aa02735101c8d47bbd06e9c370
-  data.tar.gz: 759dee1cfa6c4c99e3bfc1129d7ac6cd6996756c86abf9fb5ebcb80bfcdfc04dad0aee3a1afd9933006eb61ea0c45c41c1a34726cb3e80f8c88d28431b6fae6c
+  metadata.gz: 98b476247df5fcda19e94667066d0c0bcdf0a2f2a6e1c75aa9c045c214ea43af7321913bd1001d0bb3149e8c3e19f6c64cea46b6f45ad877ea44a48c2d1480be
+  data.tar.gz: 92e1eb6839f105a18b70bea9c77f92026c6df9e148466a27336fd7acb7478cacf187c1b4e2670f13280d3b661f739c9a00134c4f397f072327b267081937803a

data/CHANGELOG.md

@@ -1,8 +1,23 @@
-0.2.3 (Next)
+(Next)
 ===========
 
 * Your contribution here.
 
+0.5.0
+===========
+
+* [#17](https://github.com/artsy/omniauth-artsy/pull/17): specify auth_scheme for compatibility with oauth2 >=2 - [@joeyAghion](https://github.com/joeyAghion).
+
+0.4.0
+============
+
+* [#16](https://github.com/artsy/omniauth-artsy/pull/16): Disallow GET requests for omniauth - [@starsirius](https://github.com/starsirius).
+
+0.3.0
+============
+
+* [#14](https://github.com/artsy/omniauth-artsy/pull/14): Allow GET requests for omniauth - [@ansor4](https://github.com/ansor4).
+
 0.2.3
 ============
 

data/lib/omniauth/strategies/artsy.rb

@@ -9,13 +9,8 @@ module OmniAuth
         option :client_options,
                site: OmniAuth::Artsy.config.artsy_api_url || ENV['ARTSY_API_URL'] || ENV['gravity_url'],
                authorize_url: '/oauth2/authorize?scope=offline_access&response_type=code',
-               token_url: '/oauth2/access_token?scope=offline_access&response_type=code&grant_type=authorization_code'
-        # TODO: Allow GET requests to redirect to /auth/artsy for now, which exposes us
-        # to CSRF attacks. We'll want to change the auth redirect behavior to a POST
-        # request at some point in the future.
-        # https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284
-        OmniAuth.config.allowed_request_methods = %i[post get] if OmniAuth.config.respond_to?(:allowed_request_methods=)
-        OmniAuth.config.silence_get_warning = true if OmniAuth.config.respond_to?(:silence_get_warning=)
+               token_url: '/oauth2/access_token?scope=offline_access&response_type=code&grant_type=authorization_code',
+               auth_scheme: :request_body
       end
 
       configure

data/lib/omniauth-artsy/version.rb

@@ -2,6 +2,6 @@
 
 module Omniauth
   module Artsy
-    VERSION = '0.3.0'
+    VERSION = '0.5.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-artsy
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Artsy
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-03-01 00:00:00.000000000 Z
+date: 2023-10-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth-oauth2
@@ -110,7 +110,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.9
+rubygems_version: 3.4.19
 signing_key:
 specification_version: 4
 summary: Omniauth plugin for Artsy authentication.