Skip to content

Remove 'omniauth-rails_csrf_protection'

Jessie Young requested to merge jy-csrf-gem into master

What does this MR do and why?

  • Use Gitlab::RequestForgeryProtection instead
  • Previously, this gem was added because there was an OAuth error being raised without it.
  • Turns out this is because Gitlab::RequestForgeryProtection was being called before_request_phase but needed to be called in request_validation_phase (was being ignored as a result)
  • See this related PR: https://github.com/cookpad/omniauth-rails_csrf_protection/pull/9
  • Issue: #374011 (closed)

Screenshots or screen recordings

Before (CSRF gem removed but no change to omniauth initializer):

Screen_Recording_2022-09-19_at_1.52.18_PM

After:

Screen_Recording_2022-09-19_at_1.50.22_PM

How to set up and validate locally

Set up OAuth locally and confirm that the login flow works. I tested Google OAuth: https://docs.gitlab.com/ee/integration/google.html

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Jessie Young

Merge request reports