Merge pull request #121 from faberge-eggs/SSRF-idref-fix

Avoid SSRF for claimed_id request
openid · Jun 26, 2019 · d181a8a · d181a8a
2 parents 6182dc4 + 8a4c31a
commit d181a8a
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/openid/consumer/idres.rb b/lib/openid/consumer/idres.rb
@@ -72,9 +72,9 @@ def signed_fields
       def id_res
         check_for_fields
         verify_return_to
-        verify_discovery_results
         check_signature
         check_nonce
+        verify_discovery_results
       end
 
       def server_url