Skip to content

Fix valid_response_type? discarding the fail! Rack response - #218

Open
cnorthwood wants to merge 1 commit into
omniauth:masterfrom
cnorthwood:fix/valid-response-type-nil-rack-response
Open

cnorthwood wants to merge 1 commit into
omniauth:masterfrom
cnorthwood:fix/valid-response-type-nil-rack-response

Conversation

@cnorthwood

Copy link
Copy Markdown

Problem

valid_response_type? calls fail!, which invokes on_failure and produces a Rack redirect response, but then discards it by returning false:

def valid_response_type?
  return true if params.key?(configured_response_type)

  error_attrs = RESPONSE_TYPE_EXCEPTIONS[configured_response_type]
  fail!(error_attrs[:key], error_attrs[:exception_class].new(params['error']))

  false  # Rack response from fail! is discarded
end

callback_phase then does return unless valid_response_type?, which returns nil. This propagates as a nil Rack response and crashes downstream middleware:

NoMethodError: undefined method '[]' for nil
  rack/content_length.rb:23:in 'Rack::ContentLength#call'

This is triggered when the OAuth provider returns an error response (e.g. ?error=access_denied) without a code param. Related to #105.

Fix

Raise the exception instead of calling fail! directly. The exception propagates to the rescue StandardError in OmniAuth::Strategy#call!, which calls fail! and properly returns the redirect response to the client.

Fixes #217

valid_response_type? calls fail!, which invokes on_failure and produces
a Rack redirect response, but then discards it by returning false.
callback_phase then returns nil via 'return unless valid_response_type?',
which propagates as a nil Rack response and crashes downstream middleware
(e.g. Rack::ContentLength with NoMethodError: undefined method '[]' for nil).

Fix by raising the exception instead of calling fail! directly. The
exception propagates to the rescue StandardError in
OmniAuth::Strategy#call!, which calls fail! and properly returns the
redirect response to the client.

Fixes omniauth#217
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

valid_response_type? returns nil Rack response, causing 500 on auth failure callbacks

1 participant