omniauth-microsoft-identity2 1.0.0 → 1.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3af5a6cd9f8f7a4ad5c932febe95005653242fc9bd5b4a6a3b590bccded1c3da
-  data.tar.gz: 22c78044a0b051300b7dc5a26bf9d57e3389778a565ef15c84e66a645750e8e7
+  metadata.gz: 4569a0404462574684b79709fdbccccee5e8622f98ce34fb7d50eaf883447e91
+  data.tar.gz: 0cdaff3fc5ff3cfb7e43dd21b91fa2add62ed65cd59955b2c69fad9e9bafd650
 SHA512:
-  metadata.gz: 98c87218aab6c1dd088145d9974d5636f37ec0e4f3585195dc6a5af535435ea2a9b7eb3ca17c63aad90c2c09e04e2cfadb849cf0ee3a6f7c499a5dd9a7f2d928
-  data.tar.gz: b7a4ab85d4153062b4bbe3b4c25764e224fd6a33bf4cd5a42d66a39c00154a4076aff2a449bb6f5f4a4f1daff33f94c1c57a93047d576546365f6d6881762998
+  metadata.gz: b999e7fec5937388059cab737e3222ba63f2637a69e61be24f7013ec5dca19094c0928c0bad474568e1cf1bce8117e6379f9a32d804d7111c90b0c8fd4e7904e
+  data.tar.gz: 42c571fca827b0c345a4969b6058ebb92ecb4364a99ca74791b3573b196806856644e9c666bcc7fbbfbf620b1d1d2a30002b17fd813c59b9527cd502db47e15a

data/README.md

@@ -58,6 +58,12 @@ Supported options include:
 
 Request query parameters for supported authorize options are passed through in request phase.
 
+## Troubleshooting
+
+- If callback fails with `message=csrf_detected`, the OAuth `state` value could not be validated.
+- A common local smoke-test cause is host mismatch between request and callback (for example `127.0.0.1` vs `localhost`), which changes cookie scope and drops the session state cookie.
+- Use the exact same host for request and callback URLs, and register that exact callback in Entra.
+
 ## Auth Hash
 
 Example payload from `request.env['omniauth.auth']` (realistic shape, anonymized):

data/lib/omniauth/microsoft_identity2/version.rb

@@ -2,6 +2,6 @@
 
 module OmniAuth
   module MicrosoftIdentity2
-    VERSION = '1.0.0'
+    VERSION = '1.0.1'
   end
 end

data/lib/omniauth/strategies/microsoft_identity2.rb

@@ -99,6 +99,16 @@ module OmniAuth
         end
       end
 
+      def callback_phase
+        return fail_state_mismatch if missing_session_state?
+
+        super
+      rescue NoMethodError => e
+        raise unless oauth_state_nil_compare_error?(e)
+
+        fail_state_mismatch
+      end
+
       # Ensure token exchange uses a stable callback URI that matches provider config.
       def callback_url
         options[:callback_url] || options[:redirect_uri] || super
@@ -199,6 +209,21 @@ module OmniAuth
       def present?(value)
         !blank?(value)
       end
+
+      def missing_session_state?
+        present?(request.params['state']) && blank?(session['omniauth.state'])
+      end
+
+      def oauth_state_nil_compare_error?(error)
+        error.message.include?("undefined method 'bytesize' for nil")
+      end
+
+      def fail_state_mismatch
+        fail!(
+          :csrf_detected,
+          OmniAuth::Strategies::OAuth2::CallbackError.new(:csrf_detected, 'OAuth state was missing or mismatched')
+        )
+      end
     end
 
     # Backward-compatible strategy name for existing callback paths.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-microsoft-identity2
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.0.1
 platform: ruby
 authors:
 - Claudio Poli