I'm using Devise + Omniauth (actually omniauth-foursquare, the foursquare OAuth2 strategy) in my Rails app.
Upon signing in, I keep being redirected to my app (/users/sign_in#=) with the following error:
Could not authenticate you from Foursquare because "Csrf detected"
Any insights?
This is what I see last in the console:
I, [2014-10-19T19:43:38.947771 #2] INFO -- omniauth: (foursquare) Request phase initiated.
Started GET "/users/auth/foursquare" for 142.255.113... at 2014-10-19 19:43:38 +0000
Parameters: {"code"=>"2MZGM413...", "state"=>"1ba1cec3beb4..."}
Processing by Devise::SessionsController#new as HTML
Started GET "/users/auth/foursquare/callback?code=2MZGM413...&state=1ba1cec3beb4..." for 142.255.113... at 2014-10
I, [2014-10-19T19:43:39.378477 #2] INFO -- omniauth: (foursquare) Callback phase initiated.
E, [2014-10-19T19:43:39.378660 #2] ERROR -- omniauth: (foursquare) Authentication failure! csrf_detected: OmniAuth::Strategies::OAuth2::CallbackError, csrf_detected | CSRF detected
As far as I can tell, my troubles started when I received a "cookie overflow" erorr and switched to session_storing: (session_store.rb)
Rails.application.config.session_store :active_record_store, key: '_APPNAME_session', domain: 'DOMAIN.com'
Thanks!
If you inspect the source for your app, you'll see that the generated HTML includes the CSRF meta tags in the HEAD element (i.e. csrf-token and csrf-param). Most likely, one of your layouts/views is calling the csrf_meta_tags method. Try removing it to see if it works, and then consider creating a separate layout without it for forms that won't need it. Other people with more experience on frontend rails could chime in here with best practices.
Related
I've looked through various similar issues and responses but to no avail. Sorry if this is obvious but OAuth is not my area of expertise.
I'm running Rails 5.2 with Ruby 2.74 and Devise. I have SSO set up with Facebook and it works fine. I'm trying to get it working with ClassLink, but I'm stuck. When clicking on our ClassLink dashboard icon (ClassLink website), it opens a new browser window to our site, as it should, but fails to log in as that user. A user with the same email is set up on both ends. The server error is
15:14:51 web.1 | D, [2022-09-01T15:14:51.715485 #1139413] DEBUG -- omniauth: (classlink) Callback phase initiated.
15:14:51 web.1 | E, [2022-09-01T15:14:51.720435 #1139413] ERROR -- omniauth: (classlink) Authentication failure! csrf_detected: OmniAuth::Strategies::OAuth2::CallbackError, csrf_detected | CSRF detected
The Omniauth-Classlink Gem calls for a devise.rb entry of
config.omniauth :class_link,
'your-classlink-access-key',
'your-classlink-secret',
strategy_class: 'OmniAuth::Strategies::ClassLink'
but with that last parameter (strategy_class), the server won't start and exits with an error:
NoMethodError: undefined method `new' for "OmniAuth::Strategies::ClassLink":String
so I'm leaving that off since it wasn't required for my working Facebook SSO.
On the failed login I'm getting the following log entry:
Processing by Users::OmniauthCallbacksController#failure as HTML
Parameters: {"code"=>"c166206446884317a72fa1c03772a2b622c9135c526e7a", "response_type"=>"code"}
Redirected to https://dtest.pagekite.me/?locale=en
Filter chain halted as :authorize rendered or redirected
Completed 302 Found in 8ms (ActiveRecord: 0.0ms)
The domain registered on ClassLink matches our server and the callback url is correct. The permissions, routes, callback function, etc. all look OK to me (again, pretty much identical to Facebook). Any suggestions on where I might look next?
Thanks.
It sounds like you have a few different problems going on here.
15:14:51 web.1 | D, [2022-09-01T15:14:51.715485 #1139413] DEBUG -- omniauth: (classlink) Callback phase initiated. 15:14:51 web.1 | E, [2022-09-01T15:14:51.720435 #1139413] ERROR -- omniauth: (classlink) Authentication failure! csrf_detected: OmniAuth::Strategies::OAuth2::CallbackError, csrf_detected | CSRF detected
In the request phase, you receive a state parameter with a random value. The omniauth-oauth2 strategy (from which the omniauth-classlink strategy is subclassed) stores this value in the session. In the callback phase, you again receive a state parameter and it must match the one received in the request phase. This error almost always means there is something wrong with your session
NoMethodError: undefined method `new' for "OmniAuth::Strategies::ClassLink":String
The value of the strategy_class option should be the class name constant. Removing the quotes should fix it.
Processing by Users::OmniauthCallbacksController#failure as HTML Parameters: {"code"=>"c166206446884317a72fa1c03772a2b622c9135c526e7a", "response_type"=>"code"} Redirected to https://dtest.pagekite.me/?locale=en Filter chain halted as :authorize rendered or redirected Completed 302 Found in 8ms (ActiveRecord: 0.0ms)
This is Devise trying to authorize the callback request when it should not be. Is your Users::OmniauthCallbacksController calling authenticate_user! in a before action or inheriting that behavior from a parent class?
I am building rails and google oauth for a project. Right now, it is a very straight forward set up
# gemfile
gem 'rails', '~> 5.2.3'
gem 'administrate'
gem 'devise', github: 'heartcombo/devise', branch: 'ca-omniauth-2'
gem 'omniauth-google-oauth2'
gem 'dotenv-rails', groups: [:development, :test]
gem 'google-api-client', require: 'google/apis/calendar_v3'
gem 'omniauth-rails_csrf_protection'
# devise.rb
config.omniauth :google_oauth2, ENV['GOOGLE_CLIENT_ID'], ENV['GOOGLE_CLIENT_SECRET'], {
access_type: "offline",
prompt: "consent",
select_account: true,
scope: 'userinfo.email, calendar, openid',
provider_ignores_state: true
}
and then I have my code working for auth'ing with Google and logging users into devise.
I am using google calendar for a scope, which is now as of 2021 considered a sensitive scope, and because of that I have to add test users to the google project to get it to work. Currently in my google set up, I have 2 users white-listed as allowed users to use the app.
Right now, 1 user is able to log into the app just fine. They go to the page, auth with google, accept permissions, and google logs them in.
For 1 other user, google does not work. They go to the page, attempt to auth with google, and get a page back that says
SOMETHING WENT WRONG
sorry, something went wrong there. Try again.
and then are redirected to the google error page that says
400. That's an error
The server cannot process the request because it is malformed. It should not be retried.
That's all we know.
I'm not able to figure this out, because it is working perfectly for 1 user and not for the other. The only thing I can think of is looking in the heroku logs. I was able to find requests for both users.
Here are the logs for a successful login
2021-01-26T19:15:49.316985+00:00 app[web.1]: I, [2021-01-26T19:15:49.316862 #4] INFO -- : [c8194f6f-6cc9-4d1c-8ea2-9439d4a3f758] Started POST "/admin_users/auth/google_oauth2" for 108.80.197.86 at 2021-01-26 19:15:49 +0000
2021-01-26T19:15:49.317524+00:00 app[web.1]: D, [2021-01-26T19:15:49.317454 #4] DEBUG -- omniauth: (google_oauth2) Request phase initiated.
2021-01-26T19:15:49.331305+00:00 heroku[router]: at=info method=POST path="/admin_users/auth/google_oauth2" host=<host> request_id=c8194f6f-6cc9-4d1c-8ea2-9439d4a3f758 fwd="108.80.197.86" dyno=web.1 connect=1ms service=16ms status=302 bytes=1662 protocol=https
2021-01-26T19:15:59.988809+00:00 app[web.1]: I, [2021-01-26T19:15:59.988635 #4] INFO -- : [cb1c461a-de2d-47cf-97d7-c5c594dcedc2] Started GET "/admin_users/auth/google_oauth2/callback?state=<state>&code=<code>&scope=email%20https://www.googleapis.com/auth/calendar%20https://www.googleapis.com/auth/userinfo.email%20openid&authuser=0&prompt=consent" for 108.80.197.86 at 2021-01-26 19:15:59 +0000
2021-01-26T19:15:59.989574+00:00 app[web.1]: D, [2021-01-26T19:15:59.989451 #4] DEBUG -- omniauth: (google_oauth2) Callback phase initiated.
2021-01-26T19:16:00.159852+00:00 app[web.1]: I, [2021-01-26T19:16:00.159697 #4] INFO -- : [cb1c461a-de2d-47cf-97d7-c5c594dcedc2] Processing by AdminUsers::OmniauthCallbacksController#google_oauth2 as HTML
2021-01-26T19:16:00.159977+00:00 app[web.1]: I, [2021-01-26T19:16:00.159863 #4] INFO -- : [cb1c461a-de2d-47cf-97d7-c5c594dcedc2] Parameters: {"state"=>"<state>", "code"=>"<code>", "scope"=>"email https://www.googleapis.com/auth/calendar https://www.googleapis.com/auth/userinfo.email openid", "authuser"=>"0", "prompt"=>"consent"}
Here are the logs for an unsuccessful login
2021-01-26T14:16:32.326486+00:00 app[web.1]: I, [2021-01-26T14:16:32.326382 #4] INFO -- : [545e059b-7f9b-4687-8b0e-b9f7479625e2] Started POST "/admin_users/auth/google_oauth2" for 107.203.102.116 at 2021-01-26 14:16:32 +0000
2021-01-26T14:16:32.326882+00:00 app[web.1]: D, [2021-01-26T14:16:32.326810 #4] DEBUG -- omniauth: (google_oauth2) Request phase initiated.
2021-01-26T14:16:32.331603+00:00 heroku[router]: at=info method=POST path="/admin_users/auth/google_oauth2" host=<host> request_id=545e059b-7f9b-4687-8b0e-b9f7479625e2 fwd="107.203.102.116" dyno=web.1 connect=0ms service=9ms status=302 bytes=1674 protocol=https
So in looking at the logs, the unsuccessful request just stops after the user hits the google button and google seems like it's not calling back the request.
Why would it be working for 1 user, and not working for another?
Any help is much appreciated
This was resolved. the problem was the other user was using a google provided email that was not a gmail i.e. a email#domain.com email address. even though it is controlled by google, it seems like you need a gmail to auth. we switched to a gmail email and it worked fine.
ERROR MSG:
Error: Request failed with status code 500
Stack trace:
[42]/</t.exports#http://crdwk.herokuapp.com/packs/bundle-ecc8ea14dbe153e50352.js:1:89311
[42]/</t.exports#http://crdwk.herokuapp.com/packs/bundle-ecc8ea14dbe153e50352.js:1:251725
[42]/</t.exports/</d[h]#http://crdwk.herokuapp.com/packs/bundle-ecc8ea14dbe153e50352.js:1:88311
Ruby version: 2.3
Rails version: 5.1
I have a server-side rendered, client-side hydrated React/Rails app (using gem 'react-rails').
I added the gem 'rack-cors' plus setup in application.rb in order for my requests to work (I'm using axios). However, signing out (a DELETE request) fails and hitting refresh erases the current user. Neither issue occurs locally/in development.
Here's the app: http://crdwk.herokuapp.com
And the repo: https://github.com/English3000/crdwk
I took a look at my Heroku logs:
Completed 500 Internal Server Error in 8ms (ActiveRecord: 0.0ms)
NoMethodError (undefined method `reset_token' for nil:NilClass):
app/controllers/application_controller.rb:29:in `sign_out'
app/controllers/api/sessions_controller.rb:3:in `destroy'
Given that hitting refresh, the current user does not persist, the issue is the current user somehow isn't getting set.
However, this is not an issue in development. Why would that be?
Looking through my project, the only difference I can find on the backend as compared with a client-side rendered one (which I literally copy & pasted the code for this project from) is this line in application_controller.rb:
skip_before_action :verify_authenticity_token
However, if I comment out this line, when I try to sign up, I get the server error
Started POST "/api/users" for 127.0.0.1 at 2018-03-05 12:16:57 -0800
Processing by Api::UsersController#create as JSON
Parameters: {"user"=>{"email"=>"", "password"=>"[FILTERED]"}}
Can't verify CSRF token authenticity.
Completed 422 Unprocessable Entity in 1ms (ActiveRecord: 0.0ms)
ActionController::InvalidAuthenticityToken - ActionController::InvalidAuthenticityToken:
This is a result of using gem 'react-rails'. (I don't get this error for my other client-side rendered project.)
There isn't an "authenticity_token" parameter.
I find these two resources: Rails security and Learnetto's how-to.
So I add these two lines of code from the second artilce to my api.js:
const csrfToken = document.querySelector("meta[name=csrf-token]").content;
axios.defaults.headers.common["X-CSRF-Token"] = csrfToken;
Now my web app works with the extra application_controller.rb line commented out. EXCEPT, I can't use the DOM to grab the csrf token for my React Native version, so I now have the same issue for mobile...
My FB app is public (green dot) and is working perfectly fine for admins and developers. However, authentication fails when a non user tries to login.
FB app screenshot: http://imgur.com/r25vyjH
Interestingly, non-developer users are able to reach the permissions screen, but are not able to login using FB. I am using only the approved permissions:
scope: 'email, public_profile, user_friends, user_birthday'
I am on rails + devise + omniauth + omniauth-facebook.
In code, it redirects to OmniauthCallbacksController#failure. I tried creating failure action to see what's happening, but it is not giving me any message. Not sure how to debug this.
I am using following:
gem 'devise', '3.4.1'
gem 'omniauth', '1.2.2'
gem 'omniauth-facebook', '2.0.0'
Here is what I see in production.log:
I, [2015-05-01T17:55:39.141944 #2341] INFO -- : Started GET "/users/auth/facebook" for 122.167.223.121 at 2015-05-01 17:55:39 +0000
I, [2015-05-01T17:55:39.706464 #2341] INFO -- : Started GET "/users/auth/facebook/callback?code=AQC5ypphUjqzOquyD4HMWFvaCZjvMfahg5Y_...fljWMCh&state=0857ab97a79206c582b2b7b5391d99cda7b5d4e5ba2f730e" for 122.167.223.121 at 2015-05-01 17:55:39 +0000
I, [2015-05-01T17:55:41.231336 #2341] INFO -- : Processing by OmniauthCallbacksController#failure as HTML
I, [2015-05-01T17:55:41.231394 #2341] INFO -- : Parameters: {"code"=>"AQC5ypphUjqzOquyD4HMWFvaCZjvMfahg5Y...MCh", "state"=>"0857ab97a79206c582b2b7b5391d99cda7b5d4e5ba2f730e"}
I, [2015-05-01T17:55:41.232699 #2341] INFO -- : Redirected to http://www.oyelife.com/
I, [2015-05-01T17:55:41.232832 #2341] INFO -- : Completed 302 Found in 1ms (ActiveRecord: 0.0ms)
Help appreciated.
Figured this out myself after more tinkering.
Seems like callback URL must also be listed in Settings > Advanced > OAuth Settings > Valid OAuth redirect URIs. It works without it for developers, but is required for public.
Would be better if Facebook mentions this somewhere.
I got a strange error in application. It happens when I try to sign in with facebook, and than on facebook deny app the privileges that it asks for.
Here's stack trace:
Started GET "/users/auth/facebook/callback?error=access_denied&error_code=200&error_description=Permissions+error&error_reason=user_denied&state=426366bb3ac72ca4ad2b8b3fea5d5c7f628d6463b5df64a6" for 95.51.182.141 at 2013-09-05 20:55:24 +0000
(facebook) Callback phase initiated.
(facebook) Authentication failure! invalid_credentials: OmniAuth::Strategies::OAuth2::CallbackError, OmniAuth::Strategies::OAuth2::CallbackError
Processing by Devise::OmniauthCallbacksController#failure as HTML
Parameters: {"error"=>"access_denied", "error_code"=>"200", "error_description"=>"Permissions error", "error_reason"=>"user_denied", "state"=>"426366bb3ac72ca4ad2b8b3fea5d5c7f628d6463b5df64a6"}
Completed 500 Internal Server Error in 2ms
NoMethodError (undefined method `to_sym' for nil:NilClass):
vendor/bundle/ruby/1.9.1/gems/mobile-fu-1.1.1/lib/mobile-fu.rb:165:in `mobile_exempt?'
vendor/bundle/ruby/1.9.1/gems/mobile-fu-1.1.1/lib/mobile-fu.rb:114:in `set_mobile_format'
vendor/bundle/ruby/1.9.1/gems/mobile-fu-1.1.1/lib/mobile-fu.rb:89:in `set_request_format'
(...)
What's funny is that when I looked into mobile-fu code I saw that what's nil (and apparently shouldn't be) is params[:action].
I digged bit deeper and it seams that devise works funny that way, that sometimes params[:action] isn't set. Anyways it's an issue on divise <-> mobile-fu line, or that's what it seams.
Here's an issue on github (which is now closed):
https://github.com/benlangfeld/mobile-fu/issues/22#issuecomment-26775053
The fix isn't what I would wish for, but perhaps there is a reason why params[:action] (and params[:controller]) isn't set