omniauth-oauth2 from 1.7.0 to 1.7.2 broke cognito authentication

[mTouhid]

Updating omniauth-oauth2 from 1.7.0 to 1.7.2 broke the cognito authentication passthru.

[Gary-H9]

Background:
Dependabot opened a dependency relating to upgrading omniaith-oauth2 from v1.7.0 to v1.7.2. As such numerous dependencies were also upgraded. (omniauth-rails_csrf_protection was not included in the upgraded gems)

Steps taken:

• Initially we pulled the branch and ran make serve locally, this resulted in login failing.
• In addition to this running rSpec resulted in spec/acceptance/sign_in_spec.rb failing.

Running developer tools in Chrome on the locally served page, showed that after the cognito request there was no authorisation and callback requests.

Furthermore, in rSpec the following error occurred when removing the mock auth data in the sign_in_spec.rb (line 14-18).

WARN -- omniauth: Attack prevented by OmniAuth::AuthenticityTokenProtection
ERROR -- omniauth: (cognito) Authentication failure! Forbidden: OmniAuth::AuthenticityError, Forbidden redirects to the root path (FAILED - 1)

At this point we spent a few hours considering the possibility that the /sign_in route should POST and not GET. This was largely influenced by numerous mentions of this throughout other peoples troubleshooting and documentation. For example this response, this and also this "Hey all, please note that using POST as the method is the new default in OmniAuth 2+, and that is to increase security and is definitely recommended.".

Reading numerous comments further down made the team consider upgrading the CSRF protection.

gem "omniauth-rails_csrf_protection", "~> 0.1"
gem "omniauth-rails_csrf_protection", "~> 1.0.0"

We changed this, rebuilt the container and tested locally successfully (via make serve and rSpec). After this we ran the new update through the pipeline to Development and again tested successfully before allow the change to propagate into Live.

This resolution does not exclude the possibility that in future we will need to upgrade the sign_in method to use POST and not GET.

[mTouhid]

Thank you @Gary-H9. I have tested the dev and I was able to login using Azure Devl.