omniauth / omniauth-oauth2 / 39704695343

100%

push

github

Clear the stored redirect URI on every callback

It was only removed when building the access token, so a callback that
failed on CSRF or a provider error left it in the session, where a
later callback that skipped the request phase could reuse it. The
callback phase now takes it out of the session first. Subclasses that
call build_access_token without the callback phase still read it from
the session.

Add an end-to-end spec that runs the request phase and then the
callback, and checks the token request sends the authorize request's
redirect_uri. Rename the existing token request spec, which skips the
request phase and so covers the fallback.

Follows up on https://github.com/omniauth/omniauth-oauth2/pull/142
and https://github.com/omniauth/omniauth-oauth2/issues/93

24 of 24 branches covered (100.0%)

Branch coverage included in aggregate %.

2 of 2 new or added lines in 1 file covered. (100.0%)

101 of 101 relevant lines covered (100.0%)

13.25 hits per line