Changelog History
Page 1
-
v2.0.0-rc1 Changes
December 11, 2020๐ Release candidates should not be considered production-ready nor stable.
๐ Version 2.0 of OmniAuth includes some changes that may be breaking depending on how you use OmniAuth in your app.
Many thanks to the folks who contributed in code and discussion for these changes.
0๏ธโฃ OmniAuth now defaults to only POST as the allowed request_phase method.
โ Hopefully, you were already doing this as a result of the warnings due to CVE-2015-9284.
๐ For detailed context, see:
#960
#809
Resolving CVE-2015-9284This change also includes an additional configurable phase:
request_validation_phase
.Rack/Sinatra
By default, this uses rack-protection's AuthenticityToken class to validate authenticity tokens. If you are using a rack based framework like sinatra, you can find an example of how to add authenticity tokens to your view here.
๐ Rails
Because Rails handles its CSRF protection in its RequestForgeryProtection class, and stores tokens in a non-vanilla-rack friendly way, you must pass a rails-friendly validator in instead, similar to what omniauth-rails_csrf_protection does.
# Derived from https://github.com/cookpad/omniauth-rails\_csrf\_protection/blob/master/lib/omniauth/rails\_csrf\_protection/token\_verifier.rb# This specific implementation has been pared down and should not be taken as the most correct way to do this.class TokenVerifierinclude ActiveSupport::Configurableinclude ActionController::RequestForgeryProtectiondef call(env)@request = ActionDispatch::Request.new(env.dup)raise OmniAuth::AuthenticityError unless verified\_request?endprivateattr\_reader :requestdelegate :params, :session, to: :requestend# in an initializerOmniAuth.config.request\_validation\_phase = TokenVerifier.new
Alternatively, if you're already using the omniauth-rails_csrf_protection gem, I have a PR open (cookpad/omniauth-rails_csrf_protection#9) that you can use my branch to automatically configure the request_validation_phase.
๐ If you're using Rails' form helpers, they automatically include an authenticity token.
๐ If you are using hyperlinks or buttons styled to redirect to your login route, you should update these to be a submit input or a submit type button wrapped in a form.
- \<a href='/auth/developer'\>Login with Developer\</a\>+ \<%= form\_tag('/auth/developer', method: 'post') do %\>+ \<button type='submit'\>Login with Developer\</button\>+ \<% end %\>
GET
Because using GET for login poses concerns (see OWASP Cheatsheet), after upgrading OmniAuth will log a
:warn
level log with every GET request to a login path when yourOmniAuth.config.allowed_request_methods
include:get
.โ If you have a workflow that absolutely requires you to use GET for the request_phase, you can disable this warning using
OmniAuth.config.silence\_get\_warning = true
It is very important that you do not do this just to circumvent having to change your inputs or login flow, as using GET for most auth workflows is not what you want.
Unhandled Exceptions
OmniAuth now catches exceptions raised during the options_call, request_call, callback_call, and other_phase, and passes them to the
OmniAuth.config.on_failure
handler. For most apps, this means they are passed to the default FailureEndpoint class that OmniAuth provides, and redirected to/auth/failure
. If your app is wrapping OmniAuth in another middleware such as this example in Discourse, then you may need to instead write your own failure handler.Provider Namespacing
OmniAuth will no longer find constants from an ancestor class when looking for the strategy class. What this means is that
OmniAuth.builder.new(@app) doprovider :my\_providerend
Will no longer find
::MyProvider
as a strategy, and instead will only look under theOmniAuth::Strategies
namespace for theMyProvider
class.Failure Route
The failure route will now respect a strategy's path_prefix option, meaning if your strategy uses
/external
instead of/auth
as its path prefix, the failure route for that strategy will be/external/failure
.Thread Safety
The OmniAuth middleware should now be thread-safe, as we run tests with rack-freeze to check for middleware mutability. This does not guarantee that the downstream strategy is thread-safe however. If you have concerns, ask your strategy maintainers.
Frozen Strings
๐ OmniAuth will no longer throw errors if trying to run it in an app with
RUBYOPT="--enable-frozen-string-literal"
.Relative Root Apps
OmniAuth now respects the 'SCRIPT_NAME' env value, so if your app lives at
myapp.com/super
, your request path will be/super/auth/provider
, your callback path/super/auth/provider/callback
and your failure path/super/auth/failure
. -
v1.9.1 Changes
March 02, 2020๐ This release includes minor changes that remove code specific to rack versions we no longer support, it also loosens the top-end of the version of hashie we require.
๐ No breaking changes are expected with this change. If a breaking change has been introduced with this release, please open an issue.
You can view a list of commits and changed files here: v1.9.0...v1.9.1
-
v1.9.0 Changes
December 14, 2018- โก๏ธ Update
rack
to>=2.0.6
per CVE-2018-16471 - ๐ Allows usage of Hashie up to
3.7.0
- ๐ Fixes Rubocop offenses.
- โก๏ธ Update
-
v1.8.1 Changes
December 28, 2017- ๐ Fix CVE-2017-17042
-
v1.8.0 Changes
December 27, 2017- ๐ Use
warn
over$stderr.puts
- ๐ Use
-
v1.7.1 Changes
October 02, 2017 -
v1.7.0 Changes
September 28, 2017 -
v1.6.1 Changes
February 18, 2017 -
v1.6.0 Changes
February 17, 2017โก๏ธ Updates / Fixes
- ๐ Performance benchmarks for middleware call (PR: #775)
- 0๏ธโฃ Simplify Default Strategy Options (PR: #777)
- ๐ Improve perf by using
Hashie::Mash#[]
(PR: #778) - โ
Pass through
test_mode
with alternate request method (PR: #779) - โ Avoid Minitest warnings (PR: #850)
- Set
omniauth.headers
on the request phase (PR: #806) - ๐คก Set params when mocking a failure (PR: #812; Issue: #811)
- ๐ docs: TestCase expects class in strategy method array (PR: #868)
- โก๏ธ Update
AuthHash#regular_writer
to ensure that#info
is a Hash (#848) - ๐ Loosen
hashie
requirements to fix potential performance issues. Please define3.4.6
in your Gemfile if you experience issues with3.5.x
. (PR: #887; Issue: #886)
-
v1.5.0 Changes
February 11, 2017๐ Defined Support
- ๐ Required Ruby version:
>= 2.1.9
๐ Fixes
- โก๏ธ Updated Hashie's
disable_warnings
setting
โก๏ธ Updated Dependencies & Security Updates
- ๐
jruby-openssl
-~> 0.9.19
rake
->= 12.0
yard
->= 0.9
hashie
-~> 3.5.0
json
-~> 2.0.3
mime-types
-~> 3.1
rest-client
-~> 2.0.0
rspec
-~> 3.5.0
rubocop
->= 0.47
simplecov
->= 0.13
tins
-~> 1.13.0
bundler
-~> 1.14
โฌ๏ธ Dropped Support
- ๐
jruby-19mode
(EOL) 1.9.3
(EOL)2.0.0
(EOL)
- ๐ Required Ruby version: