omniauth / omniauth-oauth2 / 39814294397

100%

push

github

Support several sign-ins in progress at once

Starting a second sign-in before the first finished, in another tab or
with a double click, overwrote the session's single state, redirect
URI, and PKCE verifier, so the first one failed with csrf_detected.

The request phase now also stores each sign-in's redirect URI and PKCE
verifier by its state in session["omniauth.oauth2"], keeping the
latest 5 so abandoned sign-ins can't fill a cookie session. The
callback takes the sign-in for its state, whether it succeeds or fails.

It still writes omniauth.state, omniauth.redirect_uri, and
omniauth.pkce.verifier for the latest sign-in, and falls back to them
when no stored sign-in matches, so provider gems and tests that set
them keep working. Removing them is left for v2:
https://github.com/omniauth/omniauth-oauth2/issues/196

Fixes https://github.com/omniauth/omniauth-oauth2/issues/195

34 of 34 branches covered (100.0%)

Branch coverage included in aggregate %.

33 of 33 new or added lines in 1 file covered. (100.0%)

130 of 130 relevant lines covered (100.0%)

30.81 hits per line