omniauth / omniauth-oauth2 / 39828230475

100%

push

github

Remove the single-state session keys

1.10.0 stores each sign-in by its state in session["omniauth.oauth2"],
and only kept writing omniauth.state, omniauth.redirect_uri, and
omniauth.pkce.verifier, and falling back to them in the callback, so
code that used those keys directly kept working. Drop them: the request
phase keeps the PKCE verifier in memory until it stores the sign-in,
and a callback whose state has no stored sign-in fails with
csrf_detected, unless the provider ignores state.

Also leave code_verifier out of the token request when no verifier is
stored, instead of sending it empty.

Fixes https://github.com/omniauth/omniauth-oauth2/issues/196

38 of 38 branches covered (100.0%)

Branch coverage included in aggregate %.

14 of 14 new or added lines in 1 file covered. (100.0%)

126 of 126 relevant lines covered (100.0%)

31.09 hits per line