CSRF detected - error when clicking back button

[yeoenggu]

I am not sure where I should file this issue. Please correct me if I am wrong.

I had faced this intermittent issue during development and now in production. Only now, I had managed to find a scenario where I can recreate it in production and in development.

The sequence of events

• install the app
• after app successfully load in shopify admin (via ESDK).
• click back button on chrome browser.
• CSRF error will be thrown.

In another tab, I had shopify admin open at the top level. Click on the app, let it finish loading. Clicking back works.

I have created a bareboned version of my app. I have put down the detail steps to recreate the error in the README.md.

https://github.com/yeoenggu/test_order

Please help. Production customers are facing it. It is my first app and though it is free, I want to make it work. I had a negative review partly because of this error.

[kevinhughes27]

First - thank you for the reproduction steps and the example repo. I'll try and load this up today and have a look at what is going on.

In the meantime if you are looking into it still can you report back with what route the server is trying to respond to when the csrf is thrown? I admittedly don't know how Sinatra does csrf so I'll have to look into it.

[yeoenggu]

The following is the sequence of events and the http requests that correspond to it (taken from ngrok http inspector).

1. Go to installation page for the app.
   "GET /install"

2. Enter the url of the test shop and click install.
   "POST /login"

3. Request Authorization of the app.
   "GET /auth/shopify"

4. Approve installation
   "GET /auth/shopify/callback"

5. Application load within shopify admin

• there are 2 http requests of "GET /"

6. when I click back button on chrome
   "GET /auth/shopify/callback"

Error is thrown in oauth2.rb (omniauth-oauth2 gem). Reason is it fail the following condition:
request.params["state"] != session.delete("omniauth.state")

session.delete("omniauth.state") is nil.
shopify access token is accessible via session.

[yeoenggu]

I think this should be a omniauth-oauth2 and/or omniauth-shopify-oauth2 issue.
Please refer to omniauth/omniauth-oauth2#95.

Kindly advise. This issue impact sinatra app, it may also impact rails app.

[kevinhughes27]

Nice digging. I believe you are correct that the issue is with omniauth itself. Lets leave this issue open until it is fixed upstream.

[kevinhughes27]

can you see if this is fixed in 0.4.0 (run bundle update in your project too)

[kevinhughes27]

closing for inactivity