Data

Tools

Indexes

Applications

Experiments

Ruby

A summary of data about the Ruby ecosystem.

Recent Releases of https://github.com/omniauth/omniauth

https://github.com/omniauth/omniauth - v2.1.4

What's Changed

Full Changelog: https://github.com/omniauth/omniauth/compare/v2.1.3...v2.1.4

You may now configure an after_request_phase callback on your omniauth builder instance. This callback will be run after the request phase before returning the request result.

- Ruby
Published by BobbyMcWho 5 months ago

https://github.com/omniauth/omniauth - v2.1.3

What's Changed

New Contributors

Full Changelog: https://github.com/omniauth/omniauth/compare/v2.1.2...v2.1.3

- Ruby
Published by BobbyMcWho about 1 year ago

https://github.com/omniauth/omniauth - v2.1.2

What's Changed

New Contributors

Full Changelog: https://github.com/omniauth/omniauth/compare/v2.1.1...v2.1.2

- Ruby
Published by BobbyMcWho about 1 year ago

https://github.com/omniauth/omniauth - v2.1.1

What's Changed

New Contributors

Full Changelog: https://github.com/omniauth/omniauth/compare/v2.1.0...v2.1.1

- Ruby
Published by BobbyMcWho about 1 year ago

https://github.com/omniauth/omniauth - v1.9.2

Backports a vulnerability fix that was included in Omniauth 2.0 release to the 1.9 channel.

https://nvd.nist.gov/vuln/detail/CVE-2020-36599

Current Omniauth security policy maintains v2.0 and v2.1 channels for security releases, and security patches should not be typically expected for the v1.9 channel.

- Ruby
Published by BobbyMcWho over 3 years ago

https://github.com/omniauth/omniauth - v2.1.0

This release adds Ruby 3.0+ support.

Due to kwarg changes in ruby 3, we have bumped the minimum required version of Rack to 2.2.3, which is where ruby3 support was added.

Releasing as a minor as dependency resolution should fail at install if an application is locked to a rack below new minimum.

Full Changelog: https://github.com/omniauth/omniauth/compare/v2.0.4...v2.1.0

- Ruby
Published by BobbyMcWho almost 4 years ago

https://github.com/omniauth/omniauth - v2.0.4

This release removes unnecessary warning logging when accessing GET routes that are not related to the OmniAuth request path.

Thanks to @charlie-wasp and @sponomarev at Evil Martians for the bug find and subsequent PR.

- Ruby
Published by BobbyMcWho almost 5 years ago

https://github.com/omniauth/omniauth - Fix rescuing of application errors when call_app! is used.

As a consequence of the changes that were merged in #689, errors
thrown by strategies that utilize other_phase (or more specifically
call_app!), would be caught by omniauth, causing headaches for folks
looking to have those errors handled by their application. This
should allow for errors that come from the app to pass through, while
passing errors that come from the authentication phases to the fail!
handler.

Resolves #1030

- Ruby
Published by BobbyMcWho about 5 years ago

https://github.com/omniauth/omniauth - Fix for incorrect order of request_validation_phase in test_mode.

@jsdalton gave an awesome report of the issue present in test_mode in #1033

The current implementation of mock_call was verifying the token for all requests, regardless of whether the current path is on the omniauth request path. The change was introduced recently in 1b784ff. See #1032 for details.

This creates two problems:

  1. When test mode is on, the authenticity verification logic is run inappropriately against requests where this may not even be wanted.
  2. The behavior varies from actual production behavior, potentially allowing bugs to be introduced by unwary developers.

Note that this bug was only present when OmniAuth was configured for test_mode and using the mock_call phases.

- Ruby
Published by BobbyMcWho about 5 years ago

https://github.com/omniauth/omniauth - Allow passing rack-protection configuration to default request_validation_phase

This release now properly allows an instance of OmniAuth::AuthenticityTokenProtection (with passed in rack-protection configuration) to be used as the request_validation_phase.

Thanks @jkowens #1027

If you haven't already read the release notes for v2.0.0, you should do so.

- Ruby
Published by BobbyMcWho about 5 years ago

https://github.com/omniauth/omniauth - v2.0.0

Version 2.0 of OmniAuth includes some changes that may be breaking depending on how you use OmniAuth in your app.

Many thanks to the folks who contributed in code and discussion for these changes.

OmniAuth now defaults to only POST as the allowed request_phase method.

Hopefully, you were already doing this as a result of the warnings due to CVE-2015-9284.
For detailed context, see:
#960
#809
Resolving CVE-2015-9284

This change also includes an additional configurable phase: request_validation_phase.

Rack/Sinatra

By default, this uses rack-protection's AuthenticityToken class to validate authenticity tokens. If you are using a rack based framework like sinatra, you can find an example of how to add authenticity tokens to your view here.

Rails

Because Rails handles its CSRF protection in its RequestForgeryProtection class, and stores tokens in a non-vanilla-rack friendly way, you must pass a rails-friendly validator in instead, similar to what omniauth-rails_csrf_protection does.

Update: omniauth-rails_csrf_protection has released v1.0.0, which means if you're using this library already, you should be able to upgrade omniauth to the 2.0 series as long as omniauth-rails_csrf_protection is also upgraded '~> 1.0'

An example of creating your own non-dependency implementation is below, though I would recommend using the gem.

# Derived from https://github.com/cookpad/omniauth-rails_csrf_protection/blob/master/lib/omniauth/rails_csrf_protection/token_verifier.rb
# This specific implementation has been pared down and should not be taken as the most correct way to do this.
class TokenVerifier
  include ActiveSupport::Configurable
  include ActionController::RequestForgeryProtection

  def call(env)
    @request = ActionDispatch::Request.new(env.dup)
    raise OmniAuth::AuthenticityError unless verified_request?
  end

  private
  attr_reader :request
  delegate :params, :session, to: :request
end
# in an initializer
OmniAuth.config.request_validation_phase = TokenVerifier.new

Example Rails App

If you're using Rails' form helpers, they automatically include an authenticity token.

If you are using hyperlinks or buttons styled to redirect to your login route, you should update these to be a submit input or a submit type button wrapped in a form.

- <a href='/auth/developer'>Login with Developer</a>
+ <%= form_tag('/auth/developer', method: 'post') do %>
+  <button type='submit'>Login with Developer</button>
+ <% end %>

GET

Because using GET for login poses concerns (see OWASP Cheatsheet), after upgrading OmniAuth will log a :warn level log with every GET request to a login path when your OmniAuth.config.allowed_request_methods include :get.

If you have a workflow that absolutely requires you to use GET for the request_phase, you can disable this warning using

OmniAuth.config.silence_get_warning = true

It is very important that you do not do this just to circumvent having to change your inputs or login flow, as using GET for most auth workflows is not what you want.

Unhandled Exceptions

OmniAuth now catches exceptions raised during the options_call, request_call, callback_call, and other_phase, and passes them to the OmniAuth.config.on_failure handler. For most apps, this means they are passed to the default FailureEndpoint class that OmniAuth provides, and redirected to /auth/failure. If your app is wrapping OmniAuth in another middleware such as this example in Discourse, then you may need to instead write your own failure handler.

Provider Namespacing

OmniAuth will no longer find constants from an ancestor class when looking for the strategy class. What this means is that

OmniAuth.builder.new(@app) do
  provider :my_provider
end

Will no longer find ::MyProvider as a strategy, and instead will only look under the OmniAuth::Strategies namespace for the MyProvider class.

Failure Route

The failure route will now respect a strategy's path_prefix option, meaning if your strategy uses /external instead of /auth as its path prefix, the failure route for that strategy will be /external/failure.

Thread Safety

The OmniAuth middleware should now be thread-safe, as we run tests with rack-freeze to check for middleware mutability. This does not guarantee that the downstream strategy is thread-safe however. If you have concerns, ask your strategy maintainers.

Frozen Strings

OmniAuth will no longer throw errors if trying to run it in an app with RUBYOPT="--enable-frozen-string-literal".

Relative Root Apps

OmniAuth now respects the 'SCRIPT_NAME' env value, so if your app lives at myapp.com/super, your request path will be /super/auth/provider, your callback path /super/auth/provider/callback and your failure path /super/auth/failure.

- Ruby
Published by BobbyMcWho about 5 years ago

https://github.com/omniauth/omniauth - v2.0.0 Release Candidate 1

Release candidates should not be considered production-ready nor stable.

Version 2.0 of OmniAuth includes some changes that may be breaking depending on how you use OmniAuth in your app.

Many thanks to the folks who contributed in code and discussion for these changes.

OmniAuth now defaults to only POST as the allowed request_phase method.

Hopefully, you were already doing this as a result of the warnings due to CVE-2015-9284.
For detailed context, see:
#960
#809
Resolving CVE-2015-9284

This change also includes an additional configurable phase: request_validation_phase.

Rack/Sinatra

By default, this uses rack-protection's AuthenticityToken class to validate authenticity tokens. If you are using a rack based framework like sinatra, you can find an example of how to add authenticity tokens to your view here.

Rails

Because Rails handles its CSRF protection in its RequestForgeryProtection class, and stores tokens in a non-vanilla-rack friendly way, you must pass a rails-friendly validator in instead, similar to what omniauth-rails_csrf_protection does.

# Derived from https://github.com/cookpad/omniauth-rails_csrf_protection/blob/master/lib/omniauth/rails_csrf_protection/token_verifier.rb
# This specific implementation has been pared down and should not be taken as the most correct way to do this.
class TokenVerifier
  include ActiveSupport::Configurable
  include ActionController::RequestForgeryProtection

  def call(env)
    @request = ActionDispatch::Request.new(env.dup)
    raise OmniAuth::AuthenticityError unless verified_request?
  end

  private
  attr_reader :request
  delegate :params, :session, to: :request
end
# in an initializer
OmniAuth.config.request_validation_phase = TokenVerifier.new

Example Rails App

Alternatively, if you're already using the omniauth-rails_csrf_protection gem, I have a PR open (https://github.com/cookpad/omniauth-rails_csrf_protection/pull/9) that you can use my branch to automatically configure the request_validation_phase.

If you're using Rails' form helpers, they automatically include an authenticity token.

If you are using hyperlinks or buttons styled to redirect to your login route, you should update these to be a submit input or a submit type button wrapped in a form.

- <a href='/auth/developer'>Login with Developer</a>
+ <%= form_tag('/auth/developer', method: 'post') do %>
+  <button type='submit'>Login with Developer</button>
+ <% end %>

GET

Because using GET for login poses concerns (see OWASP Cheatsheet), after upgrading OmniAuth will log a :warn level log with every GET request to a login path when your OmniAuth.config.allowed_request_methods include :get.

If you have a workflow that absolutely requires you to use GET for the request_phase, you can disable this warning using

OmniAuth.config.silence_get_warning = true

It is very important that you do not do this just to circumvent having to change your inputs or login flow, as using GET for most auth workflows is not what you want.

Unhandled Exceptions

OmniAuth now catches exceptions raised during the options_call, request_call, callback_call, and other_phase, and passes them to the OmniAuth.config.on_failure handler. For most apps, this means they are passed to the default FailureEndpoint class that OmniAuth provides, and redirected to /auth/failure. If your app is wrapping OmniAuth in another middleware such as this example in Discourse, then you may need to instead write your own failure handler.

Provider Namespacing

OmniAuth will no longer find constants from an ancestor class when looking for the strategy class. What this means is that

OmniAuth.builder.new(@app) do
  provider :my_provider
end

Will no longer find ::MyProvider as a strategy, and instead will only look under the OmniAuth::Strategies namespace for the MyProvider class.

Failure Route

The failure route will now respect a strategy's path_prefix option, meaning if your strategy uses /external instead of /auth as its path prefix, the failure route for that strategy will be /external/failure.

Thread Safety

The OmniAuth middleware should now be thread-safe, as we run tests with rack-freeze to check for middleware mutability. This does not guarantee that the downstream strategy is thread-safe however. If you have concerns, ask your strategy maintainers.

Frozen Strings

OmniAuth will no longer throw errors if trying to run it in an app with RUBYOPT="--enable-frozen-string-literal".

Relative Root Apps

OmniAuth now respects the 'SCRIPT_NAME' env value, so if your app lives at myapp.com/super, your request path will be /super/auth/provider, your callback path /super/auth/provider/callback and your failure path /super/auth/failure.

- Ruby
Published by BobbyMcWho about 5 years ago

https://github.com/omniauth/omniauth - v1.9.1

This release includes minor changes that remove code specific to rack versions we no longer support, it also loosens the top-end of the version of hashie we require.

No breaking changes are expected with this change. If a breaking change has been introduced with this release, please open an issue.

You can view a list of commits and changed files here: https://github.com/omniauth/omniauth/compare/v1.9.0...v1.9.1

- Ruby
Published by BobbyMcWho about 6 years ago

https://github.com/omniauth/omniauth - v1.9.0

  • Update rack to >=2.0.6 per CVE-2018-16471
  • Allows usage of Hashie up to 3.7.0
  • Fixes Rubocop offenses.

- Ruby
Published by tmilewski about 7 years ago

https://github.com/omniauth/omniauth - v1.8.1

- Ruby
Published by tmilewski about 8 years ago

https://github.com/omniauth/omniauth - v1.8.0

  • Use warn over $stderr.puts

- Ruby
Published by tmilewski about 8 years ago

https://github.com/omniauth/omniauth - v1.7.1

  • Update mock_request_call to use the same logic as #912. (PR: #913)

- Ruby
Published by tmilewski over 8 years ago

https://github.com/omniauth/omniauth - v1.7.0

  • Allow for origin param to be renamed or disabled. (PR: #912; Issue: #910)

- Ruby
Published by tmilewski over 8 years ago

https://github.com/omniauth/omniauth - v1.6.1

Fixes

  • Revert #806 - "Sets omniauth.headers on the request phase" due to ActionDispatch::Cookies::CookieOverflow issues. (PR: #889; Issue: #888)

- Ruby
Published by tmilewski about 9 years ago

https://github.com/omniauth/omniauth - v1.6.0

Updates / Fixes

  • Performance benchmarks for middleware call (PR: #775)
  • Simplify Default Strategy Options (PR: #777)
  • Improve perf by using Hashie::Mash#[] (PR: #778)
  • Pass through test_mode with alternate request method (PR: #779)
  • Avoid Minitest warnings (PR: #850)
  • Set omniauth.headers on the request phase (PR: #806)
  • Set params when mocking a failure (PR: #812; Issue: #811)
  • docs: TestCase expects class in strategy method array (PR: #868)
  • Update AuthHash#regular_writer to ensure that #info is a Hash (#848)
  • Loosen hashie requirements to fix potential performance issues. Please define 3.4.6 in your Gemfile if you experience issues with 3.5.x. (PR: #887; Issue: #886)

- Ruby
Published by tmilewski about 9 years ago

https://github.com/omniauth/omniauth - v1.5.0

Defined Support

  • Required Ruby version: >= 2.1.9

Fixes

  • Updated Hashie's disable_warnings setting

Updated Dependencies & Security Updates

  • jruby-openssl - ~> 0.9.19
  • rake - >= 12.0
  • yard - >= 0.9
  • hashie - ~> 3.5.0
  • json - ~> 2.0.3
  • mime-types - ~> 3.1
  • rest-client - ~> 2.0.0
  • rspec - ~> 3.5.0
  • rubocop - >= 0.47
  • simplecov - >= 0.13
  • tins - ~> 1.13.0
  • bundler - ~> 1.14

Dropped Support

  • jruby-19mode (EOL)
  • 1.9.3 (EOL)
  • 2.0.0 (EOL)

- Ruby
Published by tmilewski about 9 years ago

https://github.com/omniauth/omniauth - v1.4.3

Security

Updates the following gem requirements to avoid dependency-related security issues:

  • jruby-openssl
  • rack
  • rest-client

- Ruby
Published by tmilewski about 9 years ago

https://github.com/omniauth/omniauth - v1.4.2

Fixes

  • Mitigate Hashie regressions

- Ruby
Published by tmilewski about 9 years ago

https://github.com/omniauth/omniauth - v1.4.1

Security Updates

  • Update Rack to => 1.6.2

- Ruby
Published by tmilewski about 9 years ago

https://github.com/omniauth/omniauth - v1.4.0

Dropped

  • Dropped support Ruby 1.8.7

Fixed

  • Silence Hashie::Mash logger on Hashie 3.5.0+
  • Use secure URL for OpenID asset

- Ruby
Published by tmilewski about 9 years ago