omniauth / omniauth-oauth2 / 39699975163

100%

push

github

Fail CSRF check instead of crashing on missing state

A callback with no state stored in the session, or with a state param
that isn't a string, raised NoMethodError from Rack::Utils.secure_compare.
Both now fail with csrf_detected. The fix and specs build on the
approach in https://github.com/omniauth/omniauth-oauth2/pull/186.

Fixes https://github.com/omniauth/omniauth-oauth2/issues/189

Co-Authored-By: Nick Stanish <nickstanish@users.noreply.github.com>

24 of 24 branches covered (100.0%)

Branch coverage included in aggregate %.

3 of 3 new or added lines in 1 file covered. (100.0%)

98 of 98 relevant lines covered (100.0%)

11.01 hits per line