closes #6553

src/routes/authentication.js

@@ -60,13 +60,20 @@ Auth.reloadRoutes = function (callback) {
		function (loginStrategies, next) {
			loginStrategies.forEach(function (strategy) {
				if (strategy.url) {
					router.get(strategy.url, passport.authenticate(strategy.name, {
						scope: strategy.scope,
						prompt: strategy.prompt || undefined,
					}));
					router.get(strategy.url, Auth.middleware.applyCSRF, function (req, res, next) {
						req.session.ssoState = req.csrfToken();
						passport.authenticate(strategy.name, {
							scope: strategy.scope,
							prompt: strategy.prompt || undefined,
							state: req.session.ssoState,
						})(req, res, next);
					});
				}

				router.get(strategy.callbackURL, function (req, res, next) {
					// Ensure the passed-back state value is identical to the saved ssoState
					next(req.query.state !== req.session.ssoState ? new Error('[[error:csrf-invalid]]') : null);
				}, function (req, res, next) {
					// Trigger registration interstitial checks
					req.session.registration = req.session.registration || {};
					next();