lib/omni_auth/request_forgery_protection.rb


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66

# Protects OmniAuth request phase against CSRF.

module OmniAuth
  # Based on ActionController::RequestForgeryProtection.
  class RequestForgeryProtection
    def initialize(env)
      @env = env
    end

    def request
      @request ||= ActionDispatch::Request.new(@env)
    end

    def session
      request.session
    end

    def reset_session
      request.reset_session
    end

    def params
      request.params
    end

    def call
      verify_authenticity_token
    end

    def verify_authenticity_token
      if !verified_request?
        Rails.logger.warn "Can't verify CSRF token authenticity" if Rails.logger
        handle_unverified_request
      end
    end

    private

    def protect_against_forgery?
      ApplicationController.allow_forgery_protection
    end

    def request_forgery_protection_token
      ApplicationController.request_forgery_protection_token
    end

    def forgery_protection_strategy
      ApplicationController.forgery_protection_strategy
    end

    def verified_request?
      !protect_against_forgery? || request.get? || request.head? ||
        form_authenticity_token == params[request_forgery_protection_token] ||
        form_authenticity_token == request.headers['X-CSRF-Token']
    end

    def handle_unverified_request
      forgery_protection_strategy.new(self).handle_unverified_request
    end

    # Sets the token value for the current session.
    def form_authenticity_token
      session[:_csrf_token] ||= SecureRandom.base64(32)
    end
  end
end