Skip to content

Avoid failing redirects in omniauth strategies #4707

@tramuntanal

Description

@tramuntanal

Describe the bug
When an omniauth strategy, after a failure, redirects to any action in OmniauthRegistrationsController CurrentOrganization middleware is bypassed and the NeedsOrganization module prevents access to the redirected OmniauthRegistrationsController#**** action.

To Reproduce
Steps to reproduce the behavior:

  1. Have a strategy configured
  2. Make it fail (for example, in an OAuth2 strategy, call the callback url without the 'state' param and a csrf_detected error will be raised)
  3. You are redirected to system login because the before_action :verify_organization redirects there.

Expected behavior
If some failure happens or the authentication process is somehow aborted by the user I expect to be redirected to the same organization's views.

If CurrentOrganization is executed before Warden, redirects work great.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions