René's URL Explorer Experiment

Title: Bump omniauth from 1.9.1 to 2.0.0 by dependabot[bot] · Pull Request #435 · tip4commit/tip4commit · GitHub

Open Graph Title: Bump omniauth from 1.9.1 to 2.0.0 by dependabot[bot] · Pull Request #435 · tip4commit/tip4commit

X Title: Bump omniauth from 1.9.1 to 2.0.0 by dependabot[bot] · Pull Request #435 · tip4commit/tip4commit

Description: Bumps omniauth from 1.9.1 to 2.0.0. Release notes Sourced from omniauth's releases. v2.0.0 Version 2.0 of OmniAuth includes some changes that may be breaking depending on how you use OmniAuth in your app. Many thanks to the folks who contributed in code and discussion for these changes. OmniAuth now defaults to only POST as the allowed request_phase method. Hopefully, you were already doing this as a result of the warnings due to CVE-2015-9284. For detailed context, see: #960 #809 Resolving CVE-2015-9284 This change also includes an additional configurable phase: request_validation_phase. Rack/Sinatra By default, this uses rack-protection's AuthenticityToken class to validate authenticity tokens. If you are using a rack based framework like sinatra, you can find an example of how to add authenticity tokens to your view here. Rails Because Rails handles its CSRF protection in its RequestForgeryProtection class, and stores tokens in a non-vanilla-rack friendly way, you must pass a rails-friendly validator in instead, similar to what omniauth-rails_csrf_protection does. Update: omniauth-rails_csrf_protection has released v1.0.0, which means if you're using this library already, you should be able to upgrade omniauth to the 2.0 series as long as omniauth-rails_csrf_protection is also upgraded '~> 1.0' An example of creating your own non-dependency implementation is below, though I would recommend using the gem. # Derived from https://github.com/cookpad/omniauth-rails_csrf_protection/blob/master/lib/omniauth/rails_csrf_protection/token_verifier.rb # This specific implementation has been pared down and should not be taken as the most correct way to do this. class TokenVerifier include ActiveSupport::Configurable include ActionController::RequestForgeryProtection def call(env) @​request = ActionDispatch::Request.new(env.dup) raise OmniAuth::AuthenticityError unless verified_request? end private attr_reader :request delegate :params, :session, to: :request end in an initializer OmniAuth.config.request_validation_phase = TokenVerifier.new Example Rails App If you're using Rails' form helpers, they automatically include an authenticity token. If you are using hyperlinks or buttons styled to redirect to your login route, you should update these to be a submit input or a submit type button wrapped in a form. - Login with Developer ... (truncated) Commits 29c8216 Merge pull request #1021 from omniauth/2_0-indev fe26931 Release 2.0.0 8a6b7a6 Merge pull request #1016 from BobbyMcWho/add-to-readme 19b3d34 Add v2.0.0 text 97714aa Tag version 1956a95 Fix deprecation warnings 1b784ff Wrap mock_call in rescue 49ca577 Merge pull request #1015 from omniauth/make-sure-strategy-passes-rack-freeze e405613 Freeze omniauth in test to verify thread safety d4c1ff0 Dup options when a strategy is dup'd or cloned Additional commits viewable in compare view You can trigger a rebase of this PR by commenting @dependabot rebase. Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: @dependabot rebase will rebase this PR @dependabot recreate will recreate this PR, overwriting any edits that have been made to it @dependabot merge will merge this PR after your CI passes on it @dependabot squash and merge will squash and merge this PR after your CI passes on it @dependabot cancel merge will cancel a previously requested merge and block automerging @dependabot reopen will reopen this PR if it is closed @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) @dependabot use these labels will set the current labels as the default for future PRs for this repo and language @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the Security Alerts page. Note Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Open Graph Description: Bumps omniauth from 1.9.1 to 2.0.0. Release notes Sourced from omniauth's releases. v2.0.0 Version 2.0 of OmniAuth includes some changes that may be breaking depending on how you use OmniAuth...

X Description: Bumps omniauth from 1.9.1 to 2.0.0. Release notes Sourced from omniauth's releases. v2.0.0 Version 2.0 of OmniAuth includes some changes that may be breaking depending on how you use Omni...

Opengraph URL: https://github.com/tip4commit/tip4commit/pull/435

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width