{"action":"created","issue":{"url":"https://api.github.com/repos/Shopify/shopify_app/issues/243","repository_url":"https://api.github.com/repos/Shopify/shopify_app","labels_url":"https://api.github.com/repos/Shopify/shopify_app/issues/243/labels{/name}","comments_url":"https://api.github.com/repos/Shopify/shopify_app/issues/243/comments","events_url":"https://api.github.com/repos/Shopify/shopify_app/issues/243/events","html_url":"https://github.com/Shopify/shopify_app/pull/243","id":144742324,"number":243,"title":"Fixes CSRF OmniAuth issue","user":{"login":"alanhill","id":2029560,"avatar_url":"https://avatars.githubusercontent.com/u/2029560?v=3","gravatar_id":"","url":"https://api.github.com/users/alanhill","html_url":"https://github.com/alanhill","followers_url":"https://api.github.com/users/alanhill/followers","following_url":"https://api.github.com/users/alanhill/following{/other_user}","gists_url":"https://api.github.com/users/alanhill/gists{/gist_id}","starred_url":"https://api.github.com/users/alanhill/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alanhill/subscriptions","organizations_url":"https://api.github.com/users/alanhill/orgs","repos_url":"https://api.github.com/users/alanhill/repos","events_url":"https://api.github.com/users/alanhill/events{/privacy}","received_events_url":"https://api.github.com/users/alanhill/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Shopify/shopify_app/labels/in%20progress","name":"in progress","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-03-30T22:52:02Z","updated_at":"2016-03-31T00:02:05Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/Shopify/shopify_app/pulls/243","html_url":"https://github.com/Shopify/shopify_app/pull/243","diff_url":"https://github.com/Shopify/shopify_app/pull/243.diff","patch_url":"https://github.com/Shopify/shopify_app/pull/243.patch"},"body":"@nwtn @kevinhughes27 I ran into the same issue as mentioned here https://github.com/Shopify/shopify_app/issues/230?_pjax=%23js-repo-pjax-container. \r\n\r\nWe're making 2 authentication requests and (I think) the last one is beating the first one, causing the token to be invalid. There's some mention of it in this issue here https://github.com/intridea/omniauth-oauth2/issues/58#issuecomment-55061098. \r\n\r\nThe error I get through Heroku logs is `Authentication failure! csrf_detected: OmniAuth::Strategies::OAuth2::CallbackError, csrf_detected | CSRF detected`\r\n\r\nI changed the refresh to 3 and had no issues, then changed it back to 0 and ran into the same issue. I then decreased from there and saw no issues with it at 1. \r\n\r\nI'm not certain this fixes the root cause, but it's seems to work. \r\n\r\nTo replicate the broken version (same steps to :tophat: this branch):\r\n\r\n1. Create a new app\r\n2. Successfully install it on your shop\r\n3. The app should be loaded and working\r\n4. Close completely out of your browser\r\n5. Re-open the browser and go back to your shop\r\n6. Try to open the app\r\n\r\nYou should see one of a few rails error screens, all along the lines of OmniAuth. The logs are telling as well, you'll see the 2 requests fire at once. If it doesn't error the first time, try one or two more, but typically first time's the charm."},"comment":{"url":"https://api.github.com/repos/Shopify/shopify_app/issues/comments/203690548","html_url":"https://github.com/Shopify/shopify_app/pull/243#issuecomment-203690548","issue_url":"https://api.github.com/repos/Shopify/shopify_app/issues/243","id":203690548,"user":{"login":"kevinhughes27","id":1965489,"avatar_url":"https://avatars.githubusercontent.com/u/1965489?v=3","gravatar_id":"","url":"https://api.github.com/users/kevinhughes27","html_url":"https://github.com/kevinhughes27","followers_url":"https://api.github.com/users/kevinhughes27/followers","following_url":"https://api.github.com/users/kevinhughes27/following{/other_user}","gists_url":"https://api.github.com/users/kevinhughes27/gists{/gist_id}","starred_url":"https://api.github.com/users/kevinhughes27/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kevinhughes27/subscriptions","organizations_url":"https://api.github.com/users/kevinhughes27/orgs","repos_url":"https://api.github.com/users/kevinhughes27/repos","events_url":"https://api.github.com/users/kevinhughes27/events{/privacy}","received_events_url":"https://api.github.com/users/kevinhughes27/received_events","type":"User","site_admin":false},"created_at":"2016-03-31T00:02:05Z","updated_at":"2016-03-31T00:02:05Z","body":"I'm not really familiar with `http-equiv=\"refresh\"` where did you get the idea to change the content number? and what is this number even for?"}}