diff --git a/lib/omniauth/strategies/oauth2.rb b/lib/omniauth/strategies/oauth2.rb index 1fa66a3..b911dbe 100644 --- a/lib/omniauth/strategies/oauth2.rb +++ b/lib/omniauth/strategies/oauth2.rb @@ -24,6 +24,7 @@ class OAuth2 option :authorize_options, [:scope] option :token_params, {} option :token_options, [] + option :provider_ignores_state, false attr_accessor :access_token @@ -68,7 +69,7 @@ def callback_phase if request.params['error'] || request.params['error_reason'] raise CallbackError.new(request.params['error'], request.params['error_description'] || request.params['error_reason'], request.params['error_uri']) end - if request.params['state'].to_s.empty? || request.params['state'] != session.delete('omniauth.state') + if !options.provider_ignores_state && (request.params['state'].to_s.empty? || request.params['state'] != session.delete('omniauth.state')) raise CallbackError.new(nil, :csrf_detected) end