DOCSEARCHbyAlgolia
Submit Docs

omniauth-rails_csrf_protection

repository·main·Indexed 42 days ago

https://github.com/cookpad/omniauth-rails_csrf_protection

A Ruby on Rails gem providing security mitigation for CVE-2015-9284 by preventing Cross-Site Request Forgery (CSRF) during the OmniAuth request phase. It disables HTTP GET access and utilizes ActionController::RequestForgeryProtection to verify authenticity tokens. Version 2.0.1.

Tokens
925
Snippets
4
Records
7
Agent score
5%

What's inside omniauth-rails_csrf_protection

  1. How omniauth-rails_csrf_protection works

    main

    This gem mitigates CSRF attacks on the OmniAuth request phase by performing two primary actions:

    1. Disabling HTTP GET access: It prevents the OAuth request phase from being accessed via the GET method.
    2. CSRF Token Verification: It inserts a Rails CSRF token verifier (using ActionController::RequestForgeryProtection logic) immediately before the request phase.

  2. Install omniauth-rails_csrf_protection

    main

    To mitigate CVE-2015-9284 (CSRF on the OmniAuth request phase) in a Ruby on Rails application, add this gem to your Gemfile and run bundle install.

    Note: If you are using OmniAuth version 2.0.0 or later, you can alternatively use the built-in mitigation by configuring OmniAuth.config.request_validation_phase directly.

    gem "omniauth-rails_csrf_protection"

  3. Configure OAuth request phase to use HTTP POST

    main

    After installing the gem, you must ensure that all links initiating an OAuth request phase are converted from HTTP GET to HTTP POST requests that include an authenticity_token.

    In Rails, you can achieve this by:

    1. Changing link_to helpers to button_to.
    2. Using link_to ..., method: :post.

  4. Mitigate CVE-2015-9284 using OmniAuth built-in configuration

    main

    If you prefer not to use this gem and are using OmniAuth version 2.0.0 or higher, you can mitigate the vulnerability by adding the following configuration to your application. This uses OmniAuth::AuthenticityTokenProtection to verify the CSRF token.

    OmniAuth.config.request_validation_phase = OmniAuth::AuthenticityTokenProtection.new(key: :_csrf_token)

  5. How TokenVerifier performs CSRF verification

    main

    The OmniAuth::RailsCsrfProtection::TokenVerifier class is a callable object used to verify Cross-Site Request Forgery (CSRF) protection tokens during the OmniAuth request phase.

    It works by including ActionController::RequestForgeryProtection and utilizing the verified_request? method. This ensures that the token verification logic used by OmniAuth matches exactly how Rails performs token verification within its own controllers.

    When the call(env) method is invoked, it performs the following steps:

    1. Wraps the Rack env in an ActionDispatch::Request.
    2. Checks if the request is verified using verified_request?.
    3. If the request is not verified, it raises an ActionController::InvalidAuthenticityToken error.

    To ensure configuration consistency, the verifier delegates its configuration settings to ActionController::Base.config, meaning any CSRF settings applied to your Rails application are automatically respected by the verifier.

    # Conceptual usage within a middleware stack or similar context
verifier = OmniAuth::RailsCsrfProtection::TokenVerifier.new
verifier.call(env)
# Raises ActionController::InvalidAuthenticityToken if CSRF check fails

  6. TokenVerifier configuration delegation

    main

    The TokenVerifier is designed to stay in sync with your Rails application's CSRF configuration. It delegates configuration access to ActionController::Base.config.

    • For Rails 8.1 and newer: The class defines self.config to return ActionController::Base.config and includes ActionController::RequestForgeryProtection directly.
    • For Rails < 8.1: The class includes ActiveSupport::Configurable and dynamically defines configuration methods that delegate to ActionController::Base.config for every key present in the Rails configuration.