omniauth-oauth2 1.10.0 → 1.10.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 56ea3a5f282231d2b4dbfc7393ab753608e47be23a5759dbe2b0bb5865a04b30
-  data.tar.gz: e3ed45d971bafe000603a58ef6221be463d08b6649065c6a6bb1de908d87fb64
+  metadata.gz: 3970b2f69a10ceb8578c0a231e39bf59cb2f96395578f6b25ef34053d674174e
+  data.tar.gz: f879284175c92010060c1bbc1137c682e9d42e499d6fc63997ebd171de513d34
 SHA512:
-  metadata.gz: 7b326c3f87b4fdee92bcf1bd41c36378f91a3a9a6678461c16f9dcec95f995eaebd40808e1d9262d485ced7cfab49007476becdc3a94e49cb1b1411f884f6723
-  data.tar.gz: b847b133de1f64cf23bae72b92e5453c0fc9846248bdd8eee71b9197632cdbdbaaaab36bc6f7792a257d20132205206619227dfc4accdc0e869bf8a4edb16c07
+  metadata.gz: 676697b73881a8faf4851d92bc20f4c12fc96e87900c9879422acc8386675d5fff713853d354915f27bbc380ed9c23bfe94afd688f7889d354e54ab34cd0d0d4
+  data.tar.gz: e88dcbbeefcb4b3ac13115a5f627e3af29259f1cdca574886477f9217beb87f77c5dac7bf5dc95078c658e90104aee3aba40557a4d7a351cb0a0c485f03e4cfd

data/lib/omniauth/strategies/oauth2.rb

@@ -19,9 +19,11 @@ module OmniAuth
       end
 
       # How many sign-ins can be in progress at once, for example in several
-      # tabs. Starting another drops the oldest. Each one adds about 300
-      # bytes to the session, which may be a 4 KB cookie.
-      MAX_STORED_SIGN_INS = 5
+      # tabs. Starting another drops the oldest. With OmniAuth's origin and
+      # params, and the encoding of a Rails cookie session, each one adds
+      # about 500 bytes with PKCE to the session, which may be a 4 KB
+      # cookie.
+      MAX_STORED_SIGN_INS = 3
 
       args %i[client_id client_secret]
 
@@ -178,8 +180,10 @@ module OmniAuth
         return {} unless options.pkce
 
         # A fresh verifier for every authorization request, as RFC 7636
-        # requires: https://tools.ietf.org/html/rfc7636#section-4.1
-        verifier = SecureRandom.hex(64)
+        # requires: https://tools.ietf.org/html/rfc7636#section-4.1. Its 32
+        # random bytes encode to 43 characters, the shortest it allows,
+        # which keeps the session small.
+        verifier = SecureRandom.urlsafe_base64(32)
         session["omniauth.pkce.verifier"] = verifier
 
         # NOTE: see https://tools.ietf.org/html/rfc7636#appendix-A

data/lib/omniauth-oauth2/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module OAuth2
-    VERSION = "1.10.0".freeze
+    VERSION = "1.10.1".freeze
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-oauth2
 version: !ruby/object:Gem::Version
-  version: 1.10.0
+  version: 1.10.1
 platform: ruby
 authors:
 - Erik Berlin
@@ -87,7 +87,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.20
+rubygems_version: 3.6.9
 specification_version: 4
 summary: An abstract OAuth2 strategy for OmniAuth.
 test_files: []