Omniauth::NoSessionError: Session Expired

[mftaher]

I'm getting session expired for twitter recently after updating the gem

(twitter) Callback phase initiated.
(twitter) Authentication failure! session_expired: OmniAuth::NoSessionError, Session Expired
OmniAuth::NoSessionError - Session Expired:
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/omniauth-oauth-1.0.1/lib/omniauth/strategies/oauth.rb:46:in callback_phase' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/omniauth-1.1.1/lib/omniauth/strategy.rb:219:incallback_call'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/omniauth-1.1.1/lib/omniauth/strategy.rb:175:in call!' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/omniauth-1.1.1/lib/omniauth/strategy.rb:157:incall'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/omniauth-1.1.1/lib/omniauth/strategy.rb:177:in call!' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/omniauth-1.1.1/lib/omniauth/strategy.rb:157:incall'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/omniauth-1.1.1/lib/omniauth/builder.rb:48:in call' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/sinatra-1.3.3/lib/sinatra/base.rb:816:inforward'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/sinatra-1.3.3/lib/sinatra/base.rb:885:in route_missing' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/sinatra-1.3.3/lib/sinatra/base.rb:846:inroute!'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/sinatra-1.3.3/lib/sinatra/base.rb:842:in route!' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/sinatra-1.3.3/lib/sinatra/base.rb:842:inroute!'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/sinatra-1.3.3/lib/sinatra/base.rb:842:in route!' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/sinatra-1.3.3/lib/sinatra/base.rb:936:indispatch!'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/sinatra-1.3.3/lib/sinatra/base.rb:769:in block in call!' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/sinatra-1.3.3/lib/sinatra/base.rb:921:inblock in invoke'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/sinatra-1.3.3/lib/sinatra/base.rb:921:in catch' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/sinatra-1.3.3/lib/sinatra/base.rb:921:ininvoke'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/sinatra-1.3.3/lib/sinatra/base.rb:769:in call!' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/sinatra-1.3.3/lib/sinatra/base.rb:755:incall'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-protection-1.2.0/lib/rack/protection/xss_header.rb:22:in call' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-protection-1.2.0/lib/rack/protection/path_traversal.rb:16:incall'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-protection-1.2.0/lib/rack/protection/json_csrf.rb:17:in call' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-protection-1.2.0/lib/rack/protection/base.rb:47:incall'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-protection-1.2.0/lib/rack/protection/xss_header.rb:22:in call' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-1.4.1/lib/rack/nulllogger.rb:9:incall'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-1.4.1/lib/rack/head.rb:9:in call' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/sinatra-1.3.3/lib/sinatra/showexceptions.rb:21:incall'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/sinatra-1.3.3/lib/sinatra/base.rb:99:in call' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-1.4.1/lib/rack/session/abstract/id.rb:205:incontext'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-1.4.1/lib/rack/session/abstract/id.rb:200:in call' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-protection-1.2.0/lib/rack/protection/xss_header.rb:22:incall'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-protection-1.2.0/lib/rack/protection/base.rb:47:in call' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-protection-1.2.0/lib/rack/protection/base.rb:47:incall'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-protection-1.2.0/lib/rack/protection/path_traversal.rb:16:in call' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-protection-1.2.0/lib/rack/protection/json_csrf.rb:17:incall'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-protection-1.2.0/lib/rack/protection/base.rb:47:in call' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-protection-1.2.0/lib/rack/protection/xss_header.rb:22:incall'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-1.4.1/lib/rack/session/abstract/id.rb:205:in context' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-1.4.1/lib/rack/session/abstract/id.rb:200:incall'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-1.4.1/lib/rack/logger.rb:15:in call' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/sinatra-1.3.3/lib/sinatra/base.rb:129:incall'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-1.4.1/lib/rack/head.rb:9:in call' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-1.4.1/lib/rack/methodoverride.rb:21:incall'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/sinatra-1.3.3/lib/sinatra/showexceptions.rb:21:in call' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/sinatra-1.3.3/lib/sinatra/base.rb:99:incall'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/sinatra-1.3.3/lib/sinatra/base.rb:1389:in block in call' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/sinatra-1.3.3/lib/sinatra/base.rb:1471:insynchronize'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/sinatra-1.3.3/lib/sinatra/base.rb:1389:in call' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-1.4.1/lib/rack/builder.rb:134:incall'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-1.4.1/lib/rack/urlmap.rb:64:in block in call' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-1.4.1/lib/rack/urlmap.rb:49:ineach'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-1.4.1/lib/rack/urlmap.rb:49:in call' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-1.4.1/lib/rack/lint.rb:48:in_call'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-1.4.1/lib/rack/lint.rb:36:in call' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-1.4.1/lib/rack/showexceptions.rb:24:incall'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-1.4.1/lib/rack/commonlogger.rb:20:in call' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/sinatra-1.3.3/lib/sinatra/base.rb:136:incall'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-1.4.1/lib/rack/chunked.rb:43:in call' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/rack-1.4.1/lib/rack/content_length.rb:14:incall'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/unicorn-4.4.0/lib/unicorn/http_server.rb:535:in process_client' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/unicorn-4.4.0/lib/unicorn/http_server.rb:610:inworker_loop'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/unicorn-4.4.0/lib/unicorn/http_server.rb:491:in spawn_missing_workers' /Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/unicorn-4.4.0/lib/unicorn/http_server.rb:141:instart'
/Users/ftaher/.rbenv/versions/1.9.3-p194/lib/ruby/gems/1.9.1/gems/unicorn-4.4.0/bin/unicorn:121:in <top (required)>' /Users/ftaher/.rbenv/versions/1.9.3-p194/bin/unicorn:23:inload'
/Users/ftaher/.rbenv/versions/1.9.3-p194/bin/unicorn:23:in `

'

I have tried almost everything but it's not working for twitter.

Any help or direction to solution is much appreciated.

Thanks

[arunagw]

can you upload a sample app? somewhere?

[mftaher]

never mind it was an issue on my end, while creating sample app it worked out well, thanks for the direction.

[mftaher]

found the exact problem:

if i enable sessions in sinatra app, then the problem occurs, but it works without set :sessions, true ... I was able to reproduce it in my test application

https://github.com/mftaher/SinatraApp-OmniAuth-Demo.git

[louismullie]

+1 - same error here.

[arunagw]

True. Adding session true is setting session as a blank hash.

I think this problem needs be reported with omniauth-oauth repo.

[jeremyhaile]

+1 This is happening for me in a Rails app (not Sinatra). After /auth/twitter/callback is redirected to by Twitter, omniauth then redirects to "/auth/failure?message=session_expired&strategy=twitter"

[stefl]

I'm seeing the same thing in Rails today. App was stable but now we're getting this quite often.

[dennismonsewicz]

+1. Has anyone come out with a work around for this?

[realadeel]

+1

[nickcampbell18]

I had this problem for a long time until I realised my rookie mistake! Chrome was rejecting cookies from localhost, so I wasn't able to set any sessions locally, not just these ones.

[deneuxa]

I have the same problem with a new app:

(twitter) Callback phase initiated.
(twitter) Authentication failure! session_expired: OmniAuth::NoSessionError, Session Expired
   OmniAuth::NoSessionError (Session Expired):
     omniauth-oauth (1.0.1) lib/omniauth/strategies/oauth.rb:46:in `callback_phase'

I tried to change my key/secrets.

oauth-facebook is working fine with the exact same app.
Any idea ???

[deneuxa]

It's strange ; with another app which use devise, it work just fine, with the exact same version of oauth-twitter (tried 0.0.17 / 1.0.0 and 1.0.1) , and same twitter-app&credentials...

[deneuxa]

Stupid me, my link was pointing to :

 =link_to 'twitter', "/auth/twitter/callback", id: "oauth_TW_signin"

when it should be :

 =link_to 'twitter', "/auth/twitter", id: "oauth_TW_signin"

Changed it and it's now working :)

[gawin]

Resolved it by setting the correct session domain value (in my case in config.ru).
This was localhost and changed it to example.com for Twitter to accept the callback.
Remember to also add your FQDN Callback URL to your Twitter App details.

use Rack::Session::EncryptedCookie, key: 'example',
                                    domain: 'example.com',
                                    path: '/',
                                    expire_after: 2_592_000,
                                    secret: ENV['SESSION_SECRET']

Found this by using a proxy to review the server response from Twitter:

provider :twitter, 'xxxxxx', 'xxxxxxx', {
    callback_path: '/auth/twitter/callback',
    site: 'https://api.twitter.com',
    authorize_path: '/oauth/authenticate',
    client_options: {
        proxy: "http://127.0.0.1:8888"
    }
}