{"action":"created","issue":{"url":"https://api.github.com/repos/intridea/omniauth-oauth2/issues/58","repository_url":"https://api.github.com/repos/intridea/omniauth-oauth2","labels_url":"https://api.github.com/repos/intridea/omniauth-oauth2/issues/58/labels{/name}","comments_url":"https://api.github.com/repos/intridea/omniauth-oauth2/issues/58/comments","events_url":"https://api.github.com/repos/intridea/omniauth-oauth2/issues/58/events","html_url":"https://github.com/intridea/omniauth-oauth2/issues/58","id":33809853,"number":58,"title":"google_oauth2 Authentication failure! csrf_detected: OmniAuth::Strategies::OAuth2::CallbackError, csrf_detected | CSRF detected","user":{"login":"gdurelle","id":7200,"avatar_url":"https://avatars.githubusercontent.com/u/7200?v=3","gravatar_id":"","url":"https://api.github.com/users/gdurelle","html_url":"https://github.com/gdurelle","followers_url":"https://api.github.com/users/gdurelle/followers","following_url":"https://api.github.com/users/gdurelle/following{/other_user}","gists_url":"https://api.github.com/users/gdurelle/gists{/gist_id}","starred_url":"https://api.github.com/users/gdurelle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gdurelle/subscriptions","organizations_url":"https://api.github.com/users/gdurelle/orgs","repos_url":"https://api.github.com/users/gdurelle/repos","events_url":"https://api.github.com/users/gdurelle/events{/privacy}","received_events_url":"https://api.github.com/users/gdurelle/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":43,"created_at":"2014-05-19T15:26:47Z","updated_at":"2016-09-22T04:13:45Z","closed_at":"2014-08-07T08:54:57Z","body":"Even when creating the state myself it got the same error.\r\n```ruby\r\nsession['omniauth.state'] =  SecureRandom.hex(24)\r\nredirect_to \"/auth/google_oauth2?state=#{session['omniauth.state']}\"\r\n```\r\nEven though the returned state is the same, meaning it should match !\r\n\r\nIsn't there a double redirect or something ? \r\nBecause if so the : \r\n```'ruby\r\nrequest.params['state'] != session.delete('omniauth.state')\r\n```\r\nin https://github.com/intridea/omniauth-oauth2/blob/master/lib/omniauth/strategies/oauth2.rb#L72 would explain the problem.\r\n=> First passes, second fail.\r\n\r\nhttps://stackoverflow.com/questions/22386149/why-am-i-getting-csrf-detected-with-omniauth-and-google/23739564#23739564"},"comment":{"url":"https://api.github.com/repos/intridea/omniauth-oauth2/issues/comments/248806715","html_url":"https://github.com/intridea/omniauth-oauth2/issues/58#issuecomment-248806715","issue_url":"https://api.github.com/repos/intridea/omniauth-oauth2/issues/58","id":248806715,"user":{"login":"johnnytomcat","id":595482,"avatar_url":"https://avatars.githubusercontent.com/u/595482?v=3","gravatar_id":"","url":"https://api.github.com/users/johnnytomcat","html_url":"https://github.com/johnnytomcat","followers_url":"https://api.github.com/users/johnnytomcat/followers","following_url":"https://api.github.com/users/johnnytomcat/following{/other_user}","gists_url":"https://api.github.com/users/johnnytomcat/gists{/gist_id}","starred_url":"https://api.github.com/users/johnnytomcat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/johnnytomcat/subscriptions","organizations_url":"https://api.github.com/users/johnnytomcat/orgs","repos_url":"https://api.github.com/users/johnnytomcat/repos","events_url":"https://api.github.com/users/johnnytomcat/events{/privacy}","received_events_url":"https://api.github.com/users/johnnytomcat/received_events","type":"User","site_admin":false},"created_at":"2016-09-22T04:13:45Z","updated_at":"2016-09-22T04:13:45Z","body":"Have you restarted your webserver process?"}}
{"actor":{"display_login":"johnnytomcat"}}