Error: Not found. Authentication passthru. with any Omniauth strategy

[lionelrudaz]

Hi everybody, I'm posting here, because none of the answers in StackOverflow seem to work. So either I've got a bug with the library, or this issue can lead to an improvement of the documentation.

Environment

• Ruby 2.7.0
• Rails 6.0.3
• Devise 4.7.1
• Omniauth 1.9.1
• omniauth-facebook 6.0.0

Current behavior

I've published my repo here: https://github.com/lionelrudaz/dunphy-api/tree/omniauth-facebook

I've followed the guide to enable Facebook login with Omniauth. I've done it three times. I've checked all the possible similar questions on Stackoverflow, including:

• https://stackoverflow.com/questions/41323346/not-found-authentication-passthru-devise-oauth-facebook
• https://stackoverflow.com/questions/17504452/devise-omniauth-facebook-error-not-found-authentication-passthru
• https://stackoverflow.com/questions/13812844/devise-omniauth-facebook-not-found-authentication-passthru
• https://stackoverflow.com/questions/16755889/i-keep-getting-not-found-authentication-passthru-for-facebook-connect-login-w

When I'm entering http://localhost:3000/users/auth/facebook/, I always get the same error.

Looks like I'm not the only one that had struggle with the error. What's strange is that most of the time, the issue either was fixed by redoing everything from scratch, restarting the server (which I did many times), upgrading rails (which I did as well from 6.0.2 to 6.0.3) or by waiting for the app to be enabled...

I've got no logs to provide, except this error.

Will be even more helpful if you provide a sample application or a test case that reproduces the error.

Expected behavior

I should be redirected to Facebook login.

Let me know if you need more information.

[apchester]

Did you get any further with this? I'm getting the same problem.

[lionelrudaz]

No, I didn't. I changed the flow to make it work differently, taking the authorization code from the client, then sending it to my Rails app.

[arcooverbeek]

@lionelrudaz and @apchester please make sure you use method: :post for you links. Also make sure JS is working.
= link_to "Sign in with Facebook", user_facebook_omniauth_authorize_path, method: :post

[apchester]

@arcooverbeek Thanks! instantly fixes the issue for me, though this doesn't appear to be the default?

[lionelrudaz]

@arcooverbeek the thing is that I was in API mode for my Rails app, and my calls were done from a different frontend application. In this case, I don't think it makes sense to post to the URL, don't you think?

[Pandenok]

@arcooverbeek using method: :post leads to WARN -- omniauth: Attack prevented by OmniAuth::AuthenticityTokenProtection. How ti fix Not found. Authentication passthru.?

[carlosantoniodasilva]

Hey all, please note that using POST as the method is the new default in OmniAuth 2+, and that is to increase security and is definitely recommended.

Devise is upgrading to that default soon: #5327, and so should you if possible. Check their release notes for more info: https://github.com/omniauth/omniauth/releases/tag/v2.0.0.

If you're getting to that error it means OmniAuth is not catching the route and doing its thing, and instead you're landing directly in Rails/Devise.

@lionelrudaz are you still encountering the problem you originally reported?

[Pandenok]

@carlosantoniodasilva thank you for coming back on this! So, another question, why OmniAuth is not catching the route?
routes.rb

devise_for :users, controllers: { omniauth_callbacks: 'omniauth_callbacks' }

Edit 1: I've recently upgraded to Rails 6.1.1 and Ruby 3.0.0. Could it be the reason?
Edit 2: I'm using this branch ref instead of the git ref directly:

gem 'devise', github: 'heartcombo/devise', branch: 'ca-omniauth-2'

Edit 3:

• Tried to add method: :post to my link
• skipped the authenticity check with skip_before_action :verify_authenticity_token, only: :facebook
• kept getting WARN -- omniauth: Attack prevented by OmniAuth::AuthenticityTokenProtection

Temporarily solution which worked for me is to downgrade to gem omniauth", "~> 1.9.1" as by this answer.

[carlosantoniodasilva]

Have you verified that the request is actually being sent as POST with the link using method: :post? That requires rails or jQuery UJS, if you're not using that in your app it may still be going through a normal GET request. You can also try changing to a button_to temporarily to test if that is the problem.

With OmniAuth 2.0+, OmniAuth.config.allowed_request_methods should default to just include :post, while previous versions should have :get and :post, that may be the reason that it's not working for you.

If that's not the case, it'd be nice if you could provide a sample app that shows the issue. I haven't been able to re-test everything myself yet with that branch. Thanks.

[jkowens]

@Pandenok I think you need to set the OmniAuth.config.request_validation_phase.

See: https://github.com/omniauth/omniauth/wiki/Upgrading-to-2.0#rails

[Pandenok]

@jkowens YEAAAAH!

1. Install the gem OmniAuth - Rails CSRF Protection
2. Add the link user_facebook_omniauth_authorize_path method: :post
3. Get the facebook omniauth working without downgrading!
   Thank youuuu!
   @carlosantoniodasilva sorry for the delay in answering. My bad...

[carlosantoniodasilva]

Awesome, I'm happy to know that is working @Pandenok, and thanks for the direction @jkowens.

I'm gonna work on getting a new devise version released this week containing the patches in that branch.

[Pandenok]

@carlosantoniodasilva you're doing amazing job!

[juliaf1]

@carlosantoniodasilva I have been going through your suggestions on different forums to fix OmniAuth and have landed on an AuthenticityTokenProtection error just like @Pandenok.

I'm using these two gems:

gem 'devise', github: 'heartcombo/devise', branch: 'ca-omniauth-2'
gem 'omniauth-facebook'

And calling the user_facebook_omniauth_authorize_path with method: :post

I tried installing OmniAuth - Rails CSRF Protection, but didn't exactly understand where I should set OmniAuth.config.request_validation_phase, so that didn't work and I keep landing on this:

Started POST "/users/auth/facebook" for ::1 at 2021-01-25 11:56:40 -0300
D, [2021-01-25T11:56:40.532147 #4264] DEBUG -- omniauth: (facebook) Request phase initiated.
W, [2021-01-25T11:56:40.532787 #4264]  WARN -- omniauth: Attack prevented by OmniAuth::AuthenticityTokenProtection
E, [2021-01-25T11:56:40.532940 #4264] ERROR -- omniauth: (facebook) Authentication failure! authenticity_error: OmniAuth::AuthenticityError, Forbidden
Processing by Users::OmniauthCallbacksController#failure as HTML

Any thoughts on how to fix this would be super appreciated.

[jkowens]

@juliaf1 did you see the Omniauth 2.0 upgrade wiki? https://github.com/omniauth/omniauth/wiki/Upgrading-to-2.0#rails

You can either add gem "omniauth-rails_csrf_protection" to your Gemfile or follow the instructions to manually set OmniAuth.config.request_validation_phase.

[carlosantoniodasilva]

@juliaf1 right, from my understanding the only thing you should need (aside from using that branch and OmniAuth 2) is what @jkowens mentioned above: add the omniauth-rails_csrf_protection to your Gemfile, and make sure that's at least ~> 1.0.

That combined with initiating the OAuth flow using a POST request (using button_to or link_to + method: :post) should be enough to get it working.

I'll probably include some documentation around this on the Devise side (changelog/readme/wiki), I'm sure more people will hit issues upgrading and will come looking here first.

[Pandenok]

@juliaf1 Julia,

I tried installing OmniAuth - Rails CSRF Protection, but didn't exactly understand where I should set OmniAuth.config.request_validation_phase, so that didn't work and I keep landing on this..

If you installed the gem, you don't need to add anything, it's the gem itself that will add request validation on any post request, so make sure as @carlosantoniodasilva stated to use a link_to + method: :post or button_to which will make by default a post request.
Please check that you omniauth gem is really updated to the latest version by running bundle omniauth update

Hope this will help!

Edit: typos and formatting edited

[michaelwebb76]

If anyone lands here and has just wasted an entire day trying to resolve this issue, re-reading this thread 20 times and screaming "WHY" into their clenched fist, you explicitly need to include gem "omniauth-rails_csrf_protection", "~> 1.0" to your Rails application Gemfile for the railtie to fire and setup the token verifier correctly - it's not sufficient to have that gem required by another gem if you, like us, have a single "authentication" gem that is used by all of your systems.

[Flip437]

Hi,

what worked for me:

• install ge "OmniAuth - Rails CSRF Protection"
• add method: :post to your link_to button.
  no more config needed.

peace

[seanmsmith23]

Gems upgraded, method: :post, disable turbo. Same issue. Sigh...

[viktorianer]

Just in case it helps anyone.

If you got your Turbo enabled and smth like <%= link_to "Sign in with Facebook", user_facebook_omniauth_authorize_path, method: :post %> still brings you a CORS-related error, make sure you read this.

TL;DR: You'd better switch to form instead of a link and set a turbo form's param to false.

It helps to switch to button_to, as long as that is not resolved on Turbo side:
hotwired/turbo#45
hotwired/turbo#176
hotwired/turbo#288

This works for me too:

<%= button_to "Sign in with Microsoft", user_microsoft_graph_omniauth_authorize_path,
          method: :post, "data-turbo": false %>

[kg-currenxie]

This works for me with turbo

gem 'omniauth-rails_csrf_protection', '~> 1.0'

and 

<%= link_to user_facebook_omniauth_authorize_path, method: :post, class: 'facebook-button', data: { turbolinks: false }  %>

No other changes

[ragesoss]

Anyone have advice for working around this problem for the case of "open link in new tab"? My login links work as expected when they are clicked normally, but "method: :post" doesn't prevent this error when a user tries to open the login in a new tab.

[Duartemartins]

This is happening to me on Rails 7 using https://github.com/andyw8/omniauth-pocket-oauth2 and none of these solutions seem to work :/.

[zal-lex]

Only replacing <%= link_to "Sign in with #{provider}", user_provider_omniauth_authorize_path, method: :post %> with <%= button_to "Sign in with #{provider}", user_provider_omniauth_authorize_path %> worked for me.

[carlosantoniodasilva]

@zal-lex are you using turbo? If so, there's a reason that it works with button_to and not link_to, see rails/rails#43430 and rails/rails#43941

[seballot]

In case it helps someone else, for me the problem was with url comparaison
I don't know why but in omniauth middleware all my request path starts with double /. i.e. //users/auth/xxx instead of /users/auth/xxx

So a quick fix is to override this method in you omniauth stategy

module OmniAuth
  module Strategies
    class MyStrategy < OmniAuth::Strategies::OAuth2
       def on_path?(path)
          current_path.squeeze("/").casecmp(path.squeeze("/")).zero?
        end

       #...
     end
  end
end

See omniauth/omniauth#1079

[bjnord]

Rails 7 doesn't have UJS by default, so the previous method: :post directive on link_to doesn't work any more. I found this on StackOverflow with the answer: Change method: :post to data: { 'turbo-method' => :post }

[ketan-survival]

Thanks @jkowens.

Adding gem 'omniauth-rails_csrf_protection' to the Gemfile and Using a form_tag with a submit button worked for me, a standalone button_to or link_to with method: :post wouldn't work.

Also gem 'omniauth-rails_csrf_protection' pulls version 1.0.1 at the time of this comment so no need to specify version.

      = form_tag(admin_user_google_oauth2_omniauth_authorize_path) do
        button(type='submit' class='btn btn-primary', style='width: 100%')
          i.fa.fa-google
          |  Sign in with Google

[hs-dliaska]

if you place button / link inside form it may cause the Not found. Authentication passthru as well. if you face this issue try removing your button / link outside the form.

[MarchandMD]

While using omniauth-github and developing locally, I was experiencing this same issue.

2 things definitely resolved this for me:

1. changing link_to to button_to (even with method: :post and data: {turbo: false} this was still necessary)
2. updating the callback url in my Oauth app setting on Github specifically. I had https://localhost:3000/users/auth/github and I needed to remove the s from https