ruby-on-rails - Rails - Linkedin Auth : Not found. 身份验证 channel

Question

您好，有一个带有 Linkedin 身份验证的应用程序，曾经运行良好。今天，我收到用户的投诉，说他们看到:未找到。身份验证 channel 。 单击使用 Linkedin 登录时。它将他们带到页面:http://XXXXX/users/auth/linkedin?locale=en

当我检查日志时，我得到:

Started GET "/users/auth/linkedin?locale=en" for ::1 at 2021-07-12 18:04:13 +0800
Processing by OmniauthCallbacksController#passthru as HTML
  Parameters: {"locale"=>"en"}
  Rendering text template
  Rendered text template (0.0ms)
Completed 404 Not Found in 3ms (Views: 0.9ms | ActiveRecord: 0.3ms)

我的 Controller 看起来像:

class OmniauthCallbacksController < Devise::OmniauthCallbacksController
  def linkedin

    @user = User.connect_to_linkedin(request.env["omniauth.auth"],current_user)
    if @user.persisted?
      flash[:notice] = I18n.t "devise.omniauth_callbacks.success"
      sign_in_and_redirect @user, :event => :authentication
    else
      session["devise.linkedin_uid"] = request.env["omniauth.auth"].except("extra")
      redirect_to new_user_registration_url
      flash[:notice] = I18n.t "devise.omniauth_callbacks.failure"

    end
  end

我的模型中有以下内容:

设计:database_authenticatable，:可注册， :可恢复、:可记住、:可追踪、:可验证、:可确认、:omniauthable、:omniauth_providers => [:linkedin

             user_linkedin_omniauth_authorize GET|POST /users/auth/linkedin(.:format)                                                omniauth_callbacks#passthru
              user_linkedin_omniauth_callback GET|POST /users/auth/linkedin/callback(.:format)                                       omniauth_callbacks#linkedin

当我将 POST 方法添加到 link_to 时，我得到以下结果:

Started POST "/users/auth/linkedin?locale=en" for ::1 at 2021-07-12 21:56:18 +0800
D, [2021-07-12T21:56:18.416654 #65475] DEBUG -- omniauth: (linkedin) Request phase initiated.
W, [2021-07-12T21:56:18.417955 #65475]  WARN -- omniauth: Attack prevented by OmniAuth::AuthenticityTokenProtection
E, [2021-07-12T21:56:18.418089 #65475] ERROR -- omniauth: (linkedin) Authentication failure! authenticity_error: OmniAuth::AuthenticityError, Forbidden
Processing by OmniauthCallbacksController#failure as HTML

还有其他东西

您知道这个突然出现的问题背后的原因是什么吗？ 几天前我做了一次 bundle 更新，然后开始出现很多错误。

到目前为止我所看到的都没有帮助。

Answer 1

我发现这是因为 OmniAuth 2 及更高版本默认启用 CSRF 保护，并且不再像您尝试的那样支持 GET 请求。

我能够通过两件事修复它:

1. 添加omniauth-rails_csrf_protection gem:https://github.com/cookpad/omniauth-rails_csrf_protection

2. 更新您的 config/initializers/omniauth.rb 以包含:

OmniAuth.config.allowed_request_methods = [:get, :post]