omniauth 2.1.4 → 2.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6adedf2d934dc7dd0ced2227b34493689ea641352aa48b4951a7bd7eb315ed12
-  data.tar.gz: b34447ed4ba1ed3ab8fc22d6a23bf97157fc5a463ede72189af1ac80a39f4328
+  metadata.gz: 50ca36a1e5d776acd239b6bf0795352777cbbb9d4cfb6cdad37b35fa42071e30
+  data.tar.gz: 5042edc2920336a00c334faeed9ef80957f83b470ce97c9dd79056d93ba11959
 SHA512:
-  metadata.gz: 055d23e2630406e528178af7f933662c832c8427df39c8dacc5d7a59a6379657792b29fbdcaf80a6259c65f3d96331c3f2caf0d9710e4bd331bb4355c0e40692
-  data.tar.gz: d64fa86620a4f17dfe2a7735ff9600020aa6be03650fdc6b321f470a8c21ee0069ce4735888ee72e55d2b63b45466db1b4c108e8bd7f1969d777eedbc38139ef
+  metadata.gz: b3a700e831fec507055fec1860e78be412699562972e2fddd79018d7a07dd0751d650d415bb8921c0207c593fe27871768d084742c6707bbb44bbf52f6222e86
+  data.tar.gz: 0f7776d3a2446974cf8fc9a93f0eaae46c92b3c20becbf4321daa64dd50dd89dbf25d618fef2ac8acd22ee5e9ec586e2db075f62670e5f2344a5907931f10bf7

data/LICENSE.md

@@ -1,4 +1,4 @@
-Copyright (c) 2010-2017 Michael Bleigh and Intridea, Inc.
+Copyright (c) 2010-2026 Michael Bleigh and Intridea, Inc.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

data/README.md

@@ -4,18 +4,18 @@
 [![Ruby](https://github.com/omniauth/omniauth/actions/workflows/main.yml/badge.svg)][githubactions]
 [![TruffleRuby](https://github.com/omniauth/omniauth/actions/workflows/truffle_ruby.yml/badge.svg)][githubactionstruffle]
 [![JRuby](https://github.com/omniauth/omniauth/actions/workflows/jruby.yml/badge.svg)][githubactionsjruby]
-[![Code Climate](https://api.codeclimate.com/v1/badges/ffd33970723587806744/maintainability)][codeclimate]
+[![Maintainability](https://qlty.sh/gh/omniauth/projects/omniauth/maintainability.svg)][qlty]
 [![Coverage Status](http://img.shields.io/coveralls/omniauth/omniauth.svg)][coveralls]
 
 [gem]: https://rubygems.org/gems/omniauth
 [githubactions]: https://github.com/omniauth/omniauth/actions/workflows/main.yml
 [githubactionstruffle]: https://github.com/omniauth/omniauth/actions/workflows/truffle_ruby.yml
 [githubactionsjruby]: https://github.com/omniauth/omniauth/actions/workflows/jruby.yml
-[codeclimate]: https://codeclimate.com/github/omniauth/omniauth
+[qlty]: https://qlty.sh/gh/omniauth/projects/omniauth
 [coveralls]: https://coveralls.io/r/omniauth/omniauth
 
 This is the documentation for the in-development branch of OmniAuth.
-You can find the documentation for the latest stable release [here](https://github.com/omniauth/omniauth/tree/v2.1.4)
+You can find the documentation for the latest stable release [here](https://github.com/omniauth/omniauth/tree/v2.3.0)
 
 ## An Introduction
 OmniAuth is a library that standardizes multi-provider authentication for
@@ -102,21 +102,39 @@ environment information on the callback request. It is entirely up to
 you how you want to implement the particulars of your application's
 authentication flow.
 
-## rack_csrf
+## Cross-Site Request Forgery (CSRF) protection
 
-`omniauth` is not OOTB-compatible with [rack_csrf](https://github.com/baldowl/rack_csrf). In order to do so, the following code needs to be added to the application bootstrapping code:
+OmniAuth protects the request phase (`POST /auth/:provider`) against
+[CSRF attacks](https://owasp.org/www-community/attacks/csrf) by default.
+It uses [`OmniAuth::AuthenticityTokenProtection`](./lib/omniauth/authenticity_token_protection.rb),
+a subclass of `Rack::Protection::AuthenticityToken` from the
+[rack-protection](https://rubygems.org/gems/rack-protection) gem.
+
+You can pass `Rack::Protection::AuthenticityToken` options to match how
+your app stores its token. For example, to work with
+[rack_csrf](https://github.com/baldowl/rack_csrf):
 
 ```ruby
-OmniAuth::AuthenticityTokenProtection.default_options(key: "csrf.token", authenticity_param: "_csrf")
+OmniAuth::AuthenticityTokenProtection.default_options(
+  key: "csrf.token",
+  authenticity_param: "_csrf"
+)
 ```
 
+`Rack::Protection::AuthenticityToken` expects Base64-encoded tokens. If
+your app handles CSRF tokens differently, use the `allow_if` option to
+implement your own check.
+
+For Rails, see [Rails (without Devise)](#rails-without-devise). For
+more options, see the
+[rack-protection documentation](https://www.rubydoc.info/gems/rack-protection/Rack/Protection/AuthenticityToken).
+
 ## Rails (without Devise)
-To get started, add the following gems
+To get started, add the gem
 
 **Gemfile**:
 ```ruby
 gem 'omniauth'
-gem "omniauth-rails_csrf_protection"
 ```
 
 Then insert OmniAuth as a middleware
@@ -126,8 +144,14 @@ Then insert OmniAuth as a middleware
 Rails.application.config.middleware.use OmniAuth::Builder do
   provider :developer if Rails.env.development?
 end
+
+OmniAuth.config.request_validation_phase = OmniAuth::AuthenticityTokenProtection.new(key: :_csrf_token)
 ```
 
+The last line makes OmniAuth check the CSRF token Rails stores in the
+session (`_csrf_token`), so the request phase uses the same token as
+your forms.
+
 Additional providers can be added here in the future. Next we wire it
 all up using routes, a controller and a login view.
 
@@ -147,16 +171,14 @@ class SessionsController < ApplicationController
 
   def create
     user_info = request.env['omniauth.auth']
-    raise user_info # Your own session management should be placed here.
+    raise user_info.inspect # Your own session management should be placed here.
   end
 end
 ```
 
 **app/views/sessions/new.html.erb**:
 ```erb
-<%= form_tag('/auth/developer', method: 'post', data: {turbo: false}) do %>
-  <button type='submit'>Login with Developer</button>
-<% end %>
+<%= button_to "Login with Developer", "/auth/developer", data: { turbo: false } %>
 ```
 
 Now if you visit `/login` and click the Login button, you should see the
@@ -208,9 +230,42 @@ to `STDOUT` but you can configure this using `OmniAuth.config.logger`:
 OmniAuth.config.logger = Rails.logger
 ```
 
+## Full Host
+OmniAuth builds the callback URL it sends to the provider from the
+request's scheme and host. The host comes from the `Host` header, or
+from `X-Forwarded-Host` or `Forwarded` when present, and a client can
+forge any of them. A forged host sends the provider a `redirect_uri` on
+someone else's site, so unless your app or a proxy in front of it
+checks the host (as Rails does with `config.hosts`), tell OmniAuth which
+host to use.
+
+The simplest way is to set the host yourself, either for every provider
+or for one, as a string or as a proc that takes the Rack env. A proc
+shouldn't return a host taken from the request without checking it.
+
+```ruby
+OmniAuth.config.full_host = 'https://example.com'
+provider :twitter, ENV['KEY'], ENV['SECRET'], full_host: 'https://admin.example.com'
+```
+
+A provider's `full_host` option takes precedence over `OmniAuth.config.full_host`.
+
+If your app serves several hosts, list them instead. A string matches
+the whole host, ignoring case, and a regexp must match the whole host.
+A request on any other host fails with `invalid_host`.
+
+```ruby
+OmniAuth.config.allowed_hosts = ['example.com', /[a-z0-9-]+\.example\.com/]
+```
+
+Until one of these is set, OmniAuth logs a warning at the start of every
+request phase.
+
 ## Origin Param
-The `origin` url parameter is typically used to inform where a user came from
-and where, should you choose to use it, they'd want to return to.
+The `origin` parameter is typically used to inform where a user came from
+and where, should you choose to use it, they'd want to return to. Send it in
+the query string or, since the request phase is a POST, as a field in the
+request form, e.g. `<input type="hidden" name="origin" value="[URL]">`.
 Omniauth supports the following settings which can be configured on a provider level:
 
 **Default**:
@@ -235,24 +290,110 @@ POST /auth/twitter
 # Note that `omniauth.origin` will always be blank.
 ```
 
+**Validate the origin before redirecting to it.** It comes from a request
+parameter or the `Referer` header, so anyone can set it to any URL.
+Redirecting to it unchecked (for example `redirect_to
+request.env['omniauth.origin']`) makes your app an open redirect. Only
+follow it if it's a path on your own site, and fall back to a default
+otherwise:
+
+```ruby
+# A local path: starts with one slash, not // or /\ (which browsers
+# treat as another host).
+origin = request.env['omniauth.origin'].to_s
+redirect_to(origin.match?(%r{\A/(?![/\\])}) ? origin : root_path)
+```
+
+The `Referer` fallback gives a full URL, which this check rejects. To
+accept those too, parse the URL and compare its host with your own.
+
+## The Rack Environment
+OmniAuth passes information to your application in the Rack environment
+(`request.env` in Rails).
+
+On the callback request (`/auth/:provider/callback`):
+
+| Key | Value |
+| --- | --- |
+| `omniauth.auth` | The [Authentication Hash](https://github.com/omniauth/omniauth/wiki/Auth-Hash-Schema) for the user who just signed in. |
+| `omniauth.origin` | Where the user came from, if known (see [Origin Param](#origin-param)). |
+| `omniauth.params` | The params sent to the request phase (`/auth/:provider`), from both the query string and the form, except `authenticity_token`. An empty hash if there were none. |
+| `omniauth.strategy` | The strategy instance handling the request. Also set on the request phase and on the setup path. |
+
+When authentication fails, OmniAuth calls `OmniAuth.config.on_failure`
+with the environment, which also includes:
+
+| Key | Value |
+| --- | --- |
+| `omniauth.error` | The exception that caused the failure, if there was one. |
+| `omniauth.error.type` | A symbol describing the failure, such as `:invalid_credentials`. |
+| `omniauth.error.strategy` | The strategy instance that failed. |
+
+`omniauth.origin` and `omniauth.params` come from the user's request, so
+treat them like any other request params and validate them before use.
+
+The default `on_failure` raises the error in development and otherwise
+redirects to `/auth/failure` with the `message`, `strategy`, and
+`origin` as query string parameters.
+
+## Session Cookies and SameSite
+OmniAuth keeps its state between the request and callback phases (for
+example the OAuth `state` parameter, `omniauth.origin`, and
+`omniauth.params`) in the Rack session. When the provider redirects or
+POSTs back to your callback from its own domain, the browser has to send
+your session cookie with that cross-site request, or the callback fails
+(often with a `csrf_detected` or invalid `state` error).
+
+- With `SameSite=Lax`, the default in Rails and in modern browsers, the
+  cookie is sent on top-level GET redirects back to your app, which covers
+  most OAuth and OpenID Connect flows.
+- With `SameSite=Strict`, it isn't, so the callback sees an empty session.
+  Use `Lax` for the session cookie, or make the callback a same-site
+  request by first answering it with a page that immediately reloads the
+  same URL (for example with `<meta http-equiv="refresh">`), after which
+  the browser sends the cookie.
+- Providers that POST to the callback (such as SAML's HTTP-POST binding or
+  OpenID Connect's `form_post` response mode) need `SameSite=None; Secure`.
+
+## Several Sign-Ins at Once
+By default the session holds one `omniauth.origin` and `omniauth.params`,
+so if a user starts a second sign-in before the first finishes (in another
+tab, for example), the first one's callback gets the second one's origin
+and params.
+
+A strategy can keep them apart when its provider sends a value from the
+request phase back to the callback, such as OAuth 2.0's `state`. Its
+request phase calls `remember_sign_in` with that value, and it overrides
+`callback_sign_in_key` to return the value from the callback:
+
+```ruby
+def request_phase
+  state = SecureRandom.hex(24)
+  remember_sign_in(state)
+  redirect authorize_url(state)
+end
+
+def callback_sign_in_key
+  request.params['state']
+end
+```
+
+OmniAuth then stores the origin and params of the latest 5 sign-ins under
+their keys in `session['omniauth.sign_ins']`, and gives each callback its
+own. It still sets `omniauth.origin` and `omniauth.params` in the session
+for the latest sign-in, and falls back to them when a callback's key isn't
+remembered.
+
 ## Resources
 The [OmniAuth Wiki](https://github.com/omniauth/omniauth/wiki) has
 actively maintained in-depth documentation for OmniAuth. It should be
 your first stop if you are wondering about a more in-depth look at
 OmniAuth, how it works, and how to use it.
 
-## OmniAuth for Enterprise
-
-Available as part of the Tidelift Subscription.
-
-The maintainers of OmniAuth and thousands of other packages are working with
-Tidelift to deliver commercial support and maintenance for the open source
-packages you use to build your applications. Save time, reduce risk, and
-improve code health, while paying the maintainers of the exact packages you use.
-[Learn more.](https://tidelift.com/subscription/pkg/rubygems-omniauth?utm_source=undefined&utm_medium=referral&utm_campaign=enterprise&utm_term=repo)
-
 ## Supported Ruby Versions
-OmniAuth is tested under 2.5, 2.6, 2.7, 3.0, 3.1, 3.2, truffleruby, and JRuby.
+OmniAuth requires Ruby 2.5 or later and Rack 2.2.8 or later, including Rack 3.
+It is tested on Ruby 2.5 through 4.0, with both Rack 2 and Rack 3, and on JRuby
+and TruffleRuby.
 
 ## Versioning
 This library aims to adhere to [Semantic Versioning 2.0.0][semver]. Violations
@@ -264,13 +405,13 @@ introduced with new major versions. As a result of this policy, you can (and
 should) specify a dependency on this gem using the [Pessimistic Version
 Constraint][pvc] with two digits of precision. For example:
 
-    spec.add_dependency 'omniauth', '~> 1.0'
+    spec.add_dependency 'omniauth', '~> 2.2'
 
-[semver]: http://semver.org/
-[pvc]: http://guides.rubygems.org/patterns/#pessimistic-version-constraint
+[semver]: https://semver.org/
+[pvc]: https://guides.rubygems.org/patterns/#pessimistic-version-constraint
 
 ## License
-Copyright (c) 2010-2017 Michael Bleigh and Intridea, Inc. See [LICENSE][] for
+Copyright (c) 2010-2026 Michael Bleigh and Intridea, Inc. See [LICENSE][] for
 details.
 
 [license]: LICENSE.md

data/SECURITY.md

@@ -7,12 +7,14 @@ currently being supported with security updates.
 
 | Version  | Supported          |
 | -------  | ------------------ |
+| 2.3.x    | :white_check_mark: |
+| 2.2.x    | :white_check_mark: |
 | 2.1.x    | :white_check_mark: |
 | 2.0.x    | :white_check_mark: |
 | <= 1.9.1 | :x:                |
 
 ## Security contact information
 
-To report a security vulnerability, please use the
-[Tidelift security contact](https://tidelift.com/security).
-Tidelift will coordinate the fix and disclosure.
+To report a security vulnerability, please use GitHub's
+[private vulnerability reporting](https://github.com/omniauth/omniauth/security/advisories/new)
+rather than opening a public issue.

data/lib/omniauth/auth_hash.rb

@@ -16,11 +16,12 @@ module OmniAuth
     # valid info hash. See InfoHash#valid? for
     # more details there.
     def valid?
-      uid? && provider? && info? && info.valid?
+      info = info()
+      uid? && provider? && !info.nil? && info.valid?
     end
 
     def regular_writer(key, value)
-      value = InfoHash.new(value) if key.to_s == 'info' && value.is_a?(::Hash) && !value.is_a?(InfoHash)
+      value = InfoHash.new(value) if key.eql?('info') && value.is_a?(Hash) && !value.is_a?(InfoHash)
       super
     end
 
@@ -30,12 +31,11 @@ module OmniAuth
       end
 
       def name
-        return self[:name] if self[:name]
+        return fetch(:name) if self[:name]
         return "#{first_name} #{last_name}".strip if first_name? || last_name?
         return nickname if nickname?
-        return email if email?
 
-        nil
+        email if email?
       end
 
       def name?
@@ -43,11 +43,37 @@ module OmniAuth
       end
       alias valid? name?
 
+      # slice, except, select, and reject return a subset of the info,
+      # which shouldn't gain a calculated name when converted with #to_hash.
+      def slice(*keys)
+        subset(super)
+      end
+
+      def except(*keys)
+        subset(super)
+      end
+
+      def select
+        subset(super)
+      end
+
+      def reject
+        subset(super)
+      end
+
       def to_hash
         hash = super
-        hash['name'] ||= name
+        hash['name'] ||= name unless instance_variable_defined?(:@subset)
         hash
       end
+
+    private
+
+      # Only whether @subset is defined matters, not its value.
+      def subset(info)
+        info.instance_variable_set(:@subset, nil)
+        info
+      end
     end
   end
 end

data/lib/omniauth/authenticity_token_protection.rb

@@ -2,9 +2,11 @@ require 'rack-protection'
 
 module OmniAuth
   class AuthenticityError < StandardError; end
+
   class AuthenticityTokenProtection < Rack::Protection::AuthenticityToken
+    # Used as a validation hook rather than as middleware, so there's no app.
     def initialize(options = {})
-      @options = default_options.merge(options)
+      super(nil, options)
     end
 
     def self.call(env)
@@ -18,13 +20,13 @@ module OmniAuth
       react env
     end
 
-    alias_method :call, :call!
+    alias call call!
 
   private
 
     def deny(_env)
-      OmniAuth.logger.send(:warn, "Attack prevented by #{self.class}")
-      raise AuthenticityError.new(options[:message])
+      OmniAuth.logger.warn("Attack prevented by #{self.class}")
+      raise AuthenticityError.new(options.fetch(:message))
     end
 
     alias default_reaction deny

data/lib/omniauth/builder.rb

@@ -25,17 +25,18 @@ module OmniAuth
     end
 
     def options(options = false)
-      return @options ||= {} if options == false
-
-      @options = options
+      case options
+      when false then @options ||= {}
+      else @options = options
+      end
     end
 
     def provider(klass, *args, **opts, &block)
-      if klass.is_a?(Class)
+      if klass.instance_of?(Class)
         middleware = klass
       else
         begin
-          middleware = OmniAuth::Strategies.const_get(OmniAuth::Utils.camelize(klass.to_s).to_s, false)
+          middleware = Strategies.const_get(Utils.camelize(klass), false)
         rescue NameError
           raise(LoadError.new("Could not find matching strategy for #{klass.inspect}. You may need to install an additional gem (such as omniauth-#{klass})."))
         end
@@ -44,8 +45,10 @@ module OmniAuth
       use middleware, *args, **options.merge(opts), &block
     end
 
+    # Rack::Builder#call rebuilds the whole middleware stack on every
+    # request. Build it on the first request and reuse it after that.
     def call(env)
-      to_app.call(env)
+      (@built_app ||= to_app).call(env)
     end
   end
 end

data/lib/omniauth/failure_endpoint.rb

@@ -22,7 +22,7 @@ module OmniAuth
     end
 
     def raise_out!
-      raise(env['omniauth.error'] || OmniAuth::Error.new(env['omniauth.error.type']))
+      raise(env['omniauth.error'] || Error.new(env['omniauth.error.type']))
     end
 
     def redirect_to_failure
@@ -34,7 +34,7 @@ module OmniAuth
 
     def strategy_path_prefix
       if env['omniauth.error.strategy']
-        env['omniauth.error.strategy'].path_prefix
+        env.fetch('omniauth.error.strategy').path_prefix
       else
         OmniAuth.config.path_prefix
       end
@@ -43,13 +43,13 @@ module OmniAuth
     def strategy_name_query_param
       return '' unless env['omniauth.error.strategy']
 
-      "&strategy=#{env['omniauth.error.strategy'].name}"
+      "&strategy=#{env.fetch('omniauth.error.strategy').name}"
     end
 
     def origin_query_param
       return '' unless env['omniauth.origin']
 
-      "&origin=#{Rack::Utils.escape(env['omniauth.origin'])}"
+      "&origin=#{Rack::Utils.escape(env.fetch('omniauth.origin'))}"
     end
   end
 end

data/lib/omniauth/form.rb

@@ -13,12 +13,12 @@ module OmniAuth
       @html = +'' # unary + string allows it to be mutable if strings are frozen
       @with_custom_button = false
       @footer = nil
-      header(options[:title], options[:header_info])
+      header(options.fetch(:title), options.fetch(:header_info))
     end
 
     def self.build(options = {}, &block)
-      form = OmniAuth::Form.new(options)
-      if block.arity > 0
+      form = Form.new(options)
+      if block.arity.positive?
         yield form
       else
         form.instance_eval(&block)
@@ -39,13 +39,11 @@ module OmniAuth
     def text_field(label, name)
       label_field(label, name)
       input_field('text', name)
-      self
     end
 
     def password_field(label, name)
       label_field(label, name)
       input_field('password', name)
-      self
     end
 
     def button(text)
@@ -58,7 +56,7 @@ module OmniAuth
     end
 
     def fieldset(legend, options = {}, &block)
-      @html << "\n<fieldset#{" style='#{options[:style]}'" if options[:style]}#{" id='#{options[:id]}'" if options[:id]}>\n  <legend>#{legend}</legend>\n"
+      @html << "\n<fieldset#{" style='#{options.fetch(:style)}'" if options[:style]}#{" id='#{options.fetch(:id)}'" if options[:id]}>\n  <legend>#{legend}</legend>\n"
       instance_eval(&block)
       @html << "\n</fieldset>"
       self
@@ -76,7 +74,7 @@ module OmniAuth
       </head>
       <body>
       <h1>#{title}</h1>
-      <form method='#{options[:method]}' #{"action='#{options[:url]}' " if options[:url]}noValidate='noValidate'>
+      <form method='#{options.fetch(:method)}' #{"action='#{options.fetch(:url)}' " if options[:url]}noValidate='noValidate'>
       HTML
       self
     end

data/lib/omniauth/key_store.rb

@@ -3,17 +3,9 @@ require 'hashie/mash'
 module OmniAuth
   # Generic helper hash that allows method access on deeply nested keys.
   class KeyStore < ::Hashie::Mash
-    # Disables warnings on Hashie 3.5.0+ for overwritten keys
+    # Disables Hashie's warnings when a key overrides a Mash method
     def self.override_logging
-      require 'hashie/version'
-      return unless Gem::Version.new(Hashie::VERSION) >= Gem::Version.new('3.5.0')
-
-      if respond_to?(:disable_warnings)
-        disable_warnings
-      else
-        define_method(:log_built_in_message) { |*| }
-        private :log_built_in_message
-      end
+      disable_warnings
     end
 
     # Disable on loading of the class

data/lib/omniauth/strategies/developer.rb

@@ -37,7 +37,8 @@ module OmniAuth
       def request_phase
         form = OmniAuth::Form.new(:title => 'User Info', :url => callback_path, :method => 'get')
         options.fields.each do |field|
-          form.text_field field.to_s.capitalize.tr('_', ' '), field.to_s
+          name = field.to_s
+          form.text_field name.capitalize.tr('_', ' '), name
         end
         form.button 'Sign In'
         form.to_response
@@ -48,10 +49,7 @@ module OmniAuth
       end
 
       info do
-        options.fields.inject({}) do |hash, field|
-          hash[field] = request.params[field.to_s]
-          hash
-        end
+        options.fields.collect { |field| [field, request.params[field.to_s]] }.to_h
       end
     end
   end