Rails 3.2 + Facebook auth + CSRF FAILURE

Question

This is the error that I see when trying to login via facebook, I always see that error. Can't seem to get rid of it:

Could not authorize you from Facebook because "Csrf detected".

I put a skip:

skip_before_filter :verify_authenticity_token

on the Omniauth callback, but still I get the error. This is in both local and prod (heroku) environments. I have set the heroku environment variables. Any idea?

Pathological

Answer 1

I found that the problem was the gem was too new and passing a STATE header to facebook, which fb didn't want. I rolled the omniauth-facebook gem version back and it worked

Pathological

Which version did you roll back to? – Flutterboard

I had the same problem, downgrading omniauth-facebook to 1.4.0 solved the problem. – Incommunicable

github.com/mkdynamic/omniauth-facebook/issues/75 and github.com/intridea/omniauth-oauth2/issues/20 for some more details – Dorran

Note: CSRF in Rails is not the same as CSRF using oauth. Those are two distinct systems trying to prevent CSRF, that is why the skip_before_filter doesn't help. – Danas

Answer 2

I had the same issue you have on the same day!! I thought it was a gem update or something like this but not at all. With a deep debugging I found that omniauth "Callback phase initiated." was called twice.

It was due to a stupid double initialization of

provider :facebook, .....

One in config/initializers/devise.rb and in another initializer.

I hope it will give you an hint to find your error

Extravagancy

I found that the problem was the gem was too new and passing a STATE header to facebook, which fb didn't want. I rolled the omniauth-facebook gem version back and it worked. – Pathological

I was having this problem with another omniauth provider and could not figure it out until seeing this. Thanks! – Floccule

Answer 3

Are you sending a p3p header maybe add...

before_filter :set_p3p
private

def set_p3p
  headers['P3P'] = 'CP="ALL DSP COR CURa ADMa DEVa OUR IND COM NAV"'
end

to your application controller

Weatherbound