{"action":"created","issue":{"url":"https://api.github.com/repos/plataformatec/devise/issues/4801","repository_url":"https://api.github.com/repos/plataformatec/devise","labels_url":"https://api.github.com/repos/plataformatec/devise/issues/4801/labels{/name}","comments_url":"https://api.github.com/repos/plataformatec/devise/issues/4801/comments","events_url":"https://api.github.com/repos/plataformatec/devise/issues/4801/events","html_url":"https://github.com/plataformatec/devise/issues/4801","id":304316791,"number":4801,"title":"Random csrf failure with omniauthable","user":{"login":"jean-francois-labbe","id":1558372,"avatar_url":"https://avatars0.githubusercontent.com/u/1558372?v=4","gravatar_id":"","url":"https://api.github.com/users/jean-francois-labbe","html_url":"https://github.com/jean-francois-labbe","followers_url":"https://api.github.com/users/jean-francois-labbe/followers","following_url":"https://api.github.com/users/jean-francois-labbe/following{/other_user}","gists_url":"https://api.github.com/users/jean-francois-labbe/gists{/gist_id}","starred_url":"https://api.github.com/users/jean-francois-labbe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jean-francois-labbe/subscriptions","organizations_url":"https://api.github.com/users/jean-francois-labbe/orgs","repos_url":"https://api.github.com/users/jean-francois-labbe/repos","events_url":"https://api.github.com/users/jean-francois-labbe/events{/privacy}","received_events_url":"https://api.github.com/users/jean-francois-labbe/received_events","type":"User","site_admin":false},"labels":[{"id":37046,"url":"https://api.github.com/repos/plataformatec/devise/labels/Needs%20more%20info","name":"Needs more info","color":"fff87a","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-03-12T10:33:08Z","updated_at":"2018-03-15T22:07:49Z","closed_at":null,"author_association":"NONE","body":"## Environment\r\n\r\n- Ruby **2.5.0**\r\n- Rails **5.1.5**\r\n- Devise **4.4.1**\r\n\r\n## Current behavior\r\nI'm using `:omniauthable` with Gitlab as a provider so gem versions are:\r\nomniauth: **1.8.1**\r\nomniauth-gitlab: **1.0.3**\r\nomniauth-oauth2: **1.5.0**\r\n\r\nI currently have random success at my login attempts. When it fails I have a `Authentication failure! csrf_detected: OmniAuth::Strategies::OAuth2::CallbackError, csrf_detected | CSRF detected`\r\n\r\nhere are Rails logs with a successful attempt followed by a failure just after.\r\n\r\n```\r\nStarted GET \"/users/auth/gitlab\" for 127.0.0.1 at 2018-03-12 11:24:04 +0100\r\nI, [2018-03-12T11:24:04.735698 #18853]  INFO -- omniauth: (gitlab) Request phase initiated.\r\nStarted GET \"/users/auth/gitlab/callback?code=18b35ed6162ce19f24b4b48636d3708c2d6f1d3cb151d3741ca713c05c1237d9&state=5e27ef770d6241110a4e4fdd5eb477018ed48fa1fc51e31b\" for 127.0.0.1 at 2018-03-12 11:24:06 +0100\r\nI, [2018-03-12T11:24:06.785922 #18853]  INFO -- omniauth: (gitlab) Callback phase initiated.\r\nProcessing by Users::OmniauthCallbacksController#gitlab as HTML\r\n  Parameters: {\"code\"=>\"18b35ed6162ce19f24b4b48636d3708c2d6f1d3cb151d3741ca713c05c1237d9\", \"state\"=>\"5e27ef770d6241110a4e4fdd5eb477018ed48fa1fc51e31b\"}\r\n  User Load (2.8ms)  SELECT  \"users\".* FROM \"users\" WHERE \"users\".\"provider\" = $1 AND \"users\".\"uid\" = $2 ORDER BY \"users\".\"id\" ASC LIMIT $3  [[\"provider\", \"gitlab\"], [\"uid\", \"2\"], [\"LIMIT\", 1]]\r\n  Visit Load (4.0ms)  SELECT  \"visits\".* FROM \"visits\" WHERE \"visits\".\"visit_token\" = $1 ORDER BY \"visits\".\"id\" ASC LIMIT $2  [[\"visit_token\", \"944638cb-a7b4-4cea-bcd3-7be9c861d3e6\"], [\"LIMIT\", 1]]\r\n  User Load (1.5ms)  SELECT  \"users\".* FROM \"users\" WHERE \"users\".\"id\" = $1 LIMIT $2  [[\"id\", 425211171], [\"LIMIT\", 1]]\r\nRedirected to http://localhost:3000/dashboard/index\r\nCompleted 302 Found in 60ms (ActiveRecord: 9.9ms)\r\n\r\nStarted GET \"/users/auth/gitlab\" for 127.0.0.1 at 2018-03-12 11:24:32 +0100\r\nI, [2018-03-12T11:24:32.596123 #18853]  INFO -- omniauth: (gitlab) Request phase initiated.\r\nStarted GET \"/users/auth/gitlab/callback?code=9f431c35c6b45e1ecfdbfb7837f4fd92ee16fbe97c629637c6064a5aafca8e6a&state=0b5cfd681574e2d766717118b5d7f8c37141b364c217bc4a\" for 127.0.0.1 at 2018-03-12 11:24:34 +0100\r\nI, [2018-03-12T11:24:34.511692 #18853]  INFO -- omniauth: (gitlab) Callback phase initiated.\r\nE, [2018-03-12T11:24:34.515092 #18853] ERROR -- omniauth: (gitlab) Authentication failure! csrf_detected: OmniAuth::Strategies::OAuth2::CallbackError, csrf_detected | CSRF detected\r\nProcessing by Users::OmniauthCallbacksController#failure as HTML\r\n  Parameters: {\"code\"=>\"9f431c35c6b45e1ecfdbfb7837f4fd92ee16fbe97c629637c6064a5aafca8e6a\", \"state\"=>\"0b5cfd681574e2d766717118b5d7f8c37141b364c217bc4a\"}\r\nRedirected to http://localhost:3000/\r\nCompleted 302 Found in 3ms (ActiveRecord: 0.0ms)\r\n```\r\n\r\n## Expected behavior\r\n\r\nI expect the sign in with omniauth to work everytime.\r\n\r\nI have no idea why this is happening. \r\nI tried to change protect_from_forgery but didn't change anything. \r\nThis is hard for me to debug as sometimes it's working sometimes not."},"comment":{"url":"https://api.github.com/repos/plataformatec/devise/issues/comments/373538418","html_url":"https://github.com/plataformatec/devise/issues/4801#issuecomment-373538418","issue_url":"https://api.github.com/repos/plataformatec/devise/issues/4801","id":373538418,"user":{"login":"jean-francois-labbe","id":1558372,"avatar_url":"https://avatars0.githubusercontent.com/u/1558372?v=4","gravatar_id":"","url":"https://api.github.com/users/jean-francois-labbe","html_url":"https://github.com/jean-francois-labbe","followers_url":"https://api.github.com/users/jean-francois-labbe/followers","following_url":"https://api.github.com/users/jean-francois-labbe/following{/other_user}","gists_url":"https://api.github.com/users/jean-francois-labbe/gists{/gist_id}","starred_url":"https://api.github.com/users/jean-francois-labbe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jean-francois-labbe/subscriptions","organizations_url":"https://api.github.com/users/jean-francois-labbe/orgs","repos_url":"https://api.github.com/users/jean-francois-labbe/repos","events_url":"https://api.github.com/users/jean-francois-labbe/events{/privacy}","received_events_url":"https://api.github.com/users/jean-francois-labbe/received_events","type":"User","site_admin":false},"created_at":"2018-03-15T22:07:49Z","updated_at":"2018-03-15T22:07:49Z","author_association":"NONE","body":"I will try to provide you one."}}
{"actor":{"display_login":"jean-francois-labbe"}}