omniauth-clever 1.2.0 → 1.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 458dce33b0c16ae69f770ac1f759d070ecb339a5
-  data.tar.gz: 2484de2c25fa6c9cf24058abef451a32cb504565
+  metadata.gz: 66fffece22d76f800d950c85b783f41f5879bfad
+  data.tar.gz: 05ccd3ee2aad3d7b5f443c53de7fc995f2e780e9
 SHA512:
-  metadata.gz: 71073ce5b8faa831d24f559e51aefd4412f7a7243e245b534148c1415f271f9dac21ebf9a33c253afc2f6ed2249bb8119ffab9acf91b29512d66bcb3bd65e3fe
-  data.tar.gz: 26a7e7e5db382cfe5149b11d3f4b7488d9ea3fea818170987251629f8be37a7569ba8223737a986889b652c0e923685fe785906f3b91d60e17323ea80841a650
+  metadata.gz: 15eec45d3d127ed0c77266692be1c75e6c7db2e5341f93e38e47b80d6071ad117fa9fb793f33afa6eb9a9a9d0fa46ece7bac407d5d01accef8f00d22f9ae8049
+  data.tar.gz: 0aa20f2e688be841911850a15a4dd032bd418c7e58e356cb1a5f41a01345772d1b29806adfe5c2deee8929cdfab9a185267c6b80f463050802259c8a14d11309

data/README.md

@@ -6,7 +6,7 @@ Unofficial OmniAuth strategy for [Clever SSO OAuth2](https://dev.clever.com/sso)
 
 Add the gem to your application's Gemfile:
 
-    gem 'omniauth-clever', '~> 1.2.0'
+    gem 'omniauth-clever', '~> 1.2.1'
 
 And then execute:
 
@@ -28,6 +28,11 @@ Rails.application.config.middleware.use OmniAuth::Builder do
 end
 ```
 
+Clever is a unique OAuth 2.0 service provider in that login sequences
+are often initiated by Clever, not the client. When Clever initiates
+login, a state parameter is not relevant nor sent.
+
+
 ## Configuring
 
 To be able to set the optional `district_id` parameter on a

data/lib/omniauth/clever/version.rb

@@ -1,5 +1,5 @@
 module Omniauth
   module Clever
-    VERSION = "1.2.0"
+    VERSION = "1.2.1"
   end
 end

data/lib/omniauth/strategies/clever.rb

@@ -4,21 +4,43 @@ require 'base64'
 module OmniAuth
   module Strategies
     class Clever < OmniAuth::Strategies::OAuth2
-      option :name, "clever"
+      # Clever is a unique OAuth 2.0 service provider in that login sequences
+      # are often initiated by Clever, not the client. When Clever initiates
+      # login, a state parameter is not relevant nor sent.
 
+      option :name, "clever"
       option :client_options, {
         :site          => 'https://api.clever.com',
         :authorize_url => 'https://clever.com/oauth/authorize',
         :token_url     => 'https://clever.com/oauth/tokens'
       }
 
+      # This option bubbles up to the OmniAuth::Strategies::OAuth2
+      # when we call super in the callback_phase below.
+      # **State will still be verified** when login is initiated by the client.
+      option :provider_ignores_state, true
+
       def token_params
         super.tap do |params|
           params[:headers] = {'Authorization' => "Basic #{Base64.strict_encode64("#{options.client_id}:#{options.client_secret}")}"}
         end
       end
 
-
+      def callback_phase
+        error = request.params["error_reason"] || request.params["error"]
+        stored_state = session.delete("omniauth.state")
+        if error
+          fail!(error, CallbackError.new(request.params["error"], request.params["error_description"] || request.params["error_reason"], request.params["error_uri"]))
+        else
+          # Only verify state if we've initiated login and have stored a state
+          # to compare to.
+          if stored_state && (!request.params["state"] || request.params["state"] != stored_state)
+            fail!(:csrf_detected, CallbackError.new(:csrf_detected, "CSRF detected"))
+          else
+            super
+          end
+        end
+      end
 
       uid{ raw_info['data']['id'] }
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-clever
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.2.1
 platform: ruby
 authors:
 - Carol Nichols
@@ -10,7 +10,7 @@ autorequire:
 bindir: bin
 cert_chain:
 - gem-public_cert.pem
-date: 2015-05-20 00:00:00.000000000 Z
+date: 2015-08-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth-oauth2
@@ -71,3 +71,4 @@ specification_version: 4
 summary: The unofficial strategy for authenticating people using clever.com to your
   application using Clever's OAuth2 provider
 test_files: []
+has_rdoc: