omniauth 2.4.0

v2.4.0

on Ruby Gems

Added

• A strategy can store its own values for the callback in the sign-in it remembers, such as an OAuth 2.0 PKCE verifier, by passing them to remember_sign_in(key, data), and read them back in the callback from remembered_sign_in, which is nil when no sign-in is remembered for the callback's key. This lets omniauth-oauth2 keep one entry per sign-in instead of a second map that stores each state again. See the README. (omniauth-oauth2#195)

Changed

• session['omniauth.sign_ins'] keeps the latest 3 sign-ins instead of 5, and each one stores less: no origin when there isn't one, and no params when they're empty or with more than 512 bytes in their keys and values, in which case OmniAuth logs a warning and the callback gets empty omniauth.params. With 5 sign-ins, each with a referer and params, a few abandoned sign-ins could overflow Rails' 4 KB cookie session and make the next one fail with ActionDispatch::Cookies::CookieOverflow. (omniauth-oauth2#195)

Fixed

• Strategy#redirect no longer raises Encoding::CompatibilityError for a URI in an encoding that isn't ASCII-compatible, such as UTF-16 or UTF-32. The URI is transcoded to UTF-8 first, with invalid or unmappable characters replaced, so both the :iframe script and the 302 work.

Security

• Strategy#redirect now escapes the target URI before interpolating it into the inline <script> emitted when the :iframe option is enabled. Previously the URI was written verbatim, so a value containing a quote, </script>, or a line terminator could break out of the JavaScript string literal and execute in the application's origin (CWE-116/79). The :iframe branch also only emits the script for an http(s) or relative/protocol-relative target; a javascript:, data:, or vbscript: URI (which escaping cannot neutralize) falls through to the ordinary 302, whose Location header is inert. The non-iframe branch now HTML-escapes the URI it writes into the 302 body, and both branches send a text/html Content-Type.
• Strategy#store_origin now refuses to persist an omniauth.origin (from the origin param or the referer) whose scheme can run as script (javascript:, data:, vbscript:), so any code that later redirects to the stored origin can't execute it. Behavior change: an origin param with one of those schemes, or one that isn't a String (such as origin[]=...), is dropped and no longer falls back to the referer. Other schemes, including non-web deep links such as myapp:// used by mobile sign-in, are still stored.

Full Changelog: v2.3.1...v2.4.0