Skip to content

Bump omniauth from 1.9.1 to 2.0.4

libautomation requested to merge dependabot/bundler/omniauth-2.0.4 into main

Bumps omniauth from 1.9.1 to 2.0.4.

Release notes

Sourced from omniauth's releases.

v2.0.4

This release removes unnecessary warning logging when accessing GET routes that are not related to the OmniAuth request path.

Thanks to @charlie-wasp and @sponomarev at Evil Martians for the bug find and subsequent PR.

Fix rescuing of application errors when call_app! is used.

As a consequence of the changes that were merged in #689, errors thrown by strategies that utilize other_phase (or more specifically call_app!), would be caught by omniauth, causing headaches for folks looking to have those errors handled by their application. This should allow for errors that come from the app to pass through, while passing errors that come from the authentication phases to the fail! handler.

Resolves #1030

Fix for incorrect order of request_validation_phase in test_mode.

@jsdalton gave an awesome report of the issue present in test_mode in #1033

The current implementation of mock_call was verifying the token for all requests, regardless of whether the current path is on the omniauth request path. The change was introduced recently in 1b784ff. See #1032 for details.

This creates two problems:

  1. When test mode is on, the authenticity verification logic is run inappropriately against requests where this may not even be wanted.
  2. The behavior varies from actual production behavior, potentially allowing bugs to be introduced by unwary developers.

Note that this bug was only present when OmniAuth was configured for test_mode and using the mock_call phases.

Allow passing rack-protection configuration to default request_validation_phase

This release now properly allows an instance of OmniAuth::AuthenticityTokenProtection (with passed in rack-protection configuration) to be used as the request_validation_phase.

Thanks @jkowens #1027

If you haven't already read the release notes for v2.0.0, you should do so.

v2.0.0

Version 2.0 of OmniAuth includes some changes that may be breaking depending on how you use OmniAuth in your app.

Many thanks to the folks who contributed in code and discussion for these changes.

OmniAuth now defaults to only POST as the allowed request_phase method.

Hopefully, you were already doing this as a result of the warnings due to CVE-2015-9284.
For detailed context, see:
#960
#809
Resolving CVE-2015-9284

This change also includes an additional configurable phase: request_validation_phase.

Rack/Sinatra

By default, this uses rack-protection's AuthenticityToken class to validate authenticity tokens. If you are using a rack based framework like sinatra, you can find an example of how to add authenticity tokens to your view here.

... (truncated)

Commits
  • e7b8811 Release v2.0.4
  • 119a54d Remove jruby-head for now
  • f0e5d42 Merge pull request #1041 from charlie-wasp/fix/get-request-warning
  • b72a8db Warn only on GET requests for login path
  • 481e307 Prepare for next development iteration
  • f9dddef v2.0.3 release
  • 7e1b49f Merge pull request #1035 from omniauth/1030-standard-error-handling
  • 6f4cdb0 Better handle errors that come from the actual app.
  • 0d533c3 Update README for next dev cycle.
  • ba115e1 Prepare for 2.0.2 release
  • Additional commits viewable in compare view

Merge request reports