DGNum/demarches-normaliennes
13
1
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity

omniauth: protect against CSRF

Browse source 
See https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284
This commit is contained in:
Pierre de La Morinerie 2019-07-15 14:35:24 +00:00
parent 329bfd5f4d
commit 76335511c8
4 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
config/initializers/omniauth.rb Normal file
View file

@ -0,0 +1,4 @@
# OmniAuth GET requests may be vulnerable to CSRF.
# Ensure that OmniAuth only uses POST requests.
# See https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284
OmniAuth.config.allowed_request_methods = [:post]