Bump omniauth from 1.9.1 to 2.0.0

[dependabot]

Bumps omniauth from 1.9.1 to 2.0.0.

Release notes

Sourced from omniauth's releases.

v2.0.0

Version 2.0 of OmniAuth includes some changes that may be breaking depending on how you use OmniAuth in your app.

Many thanks to the folks who contributed in code and discussion for these changes.

OmniAuth now defaults to only POST as the allowed request_phase method.

Hopefully, you were already doing this as a result of the warnings due to CVE-2015-9284.
For detailed context, see:
#960
#809
Resolving CVE-2015-9284

This change also includes an additional configurable phase: request_validation_phase.

Rack/Sinatra

By default, this uses rack-protection's AuthenticityToken class to validate authenticity tokens. If you are using a rack based framework like sinatra, you can find an example of how to add authenticity tokens to your view here.

Rails

Because Rails handles its CSRF protection in its RequestForgeryProtection class, and stores tokens in a non-vanilla-rack friendly way, you must pass a rails-friendly validator in instead, similar to what omniauth-rails_csrf_protection does.

Update: omniauth-rails_csrf_protection has released v1.0.0, which means if you're using this library already, you should be able to upgrade omniauth to the 2.0 series as long as omniauth-rails_csrf_protection is also upgraded '~> 1.0'

An example of creating your own non-dependency implementation is below, though I would recommend using the gem.

# Derived from https://github.com/cookpad/omniauth-rails_csrf_protection/blob/master/lib/omniauth/rails_csrf_protection/token_verifier.rb
# This specific implementation has been pared down and should not be taken as the most correct way to do this.
class TokenVerifier
  include ActiveSupport::Configurable
  include ActionController::RequestForgeryProtection
def call(env)
@​request = ActionDispatch::Request.new(env.dup)
raise OmniAuth::AuthenticityError unless verified_request?
end
private
attr_reader :request
delegate :params, :session, to: :request
end
in an initializer
OmniAuth.config.request_validation_phase = TokenVerifier.new

Example Rails App

If you're using Rails' form helpers, they automatically include an authenticity token.

If you are using hyperlinks or buttons styled to redirect to your login route, you should update these to be a submit input or a submit type button wrapped in a form.

- <a href='/auth/developer'>Login with Developer</a>
</tr></table> 

... (truncated)

Commits

• 29c8216 Merge pull request #1021 from omniauth/2_0-indev
• fe26931 Release 2.0.0
• 8a6b7a6 Merge pull request #1016 from BobbyMcWho/add-to-readme
• 19b3d34 Add v2.0.0 text
• 97714aa Tag version
• 1956a95 Fix deprecation warnings
• 1b784ff Wrap mock_call in rescue
• 49ca577 Merge pull request #1015 from omniauth/make-sure-strategy-passes-rack-freeze
• e405613 Freeze omniauth in test to verify thread safety
• d4c1ff0 Dup options when a strategy is dup'd or cloned
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #3925.