Skip to content

Upgrading omniauth 1 to 2

Breaking1.9.2 → 2.3.1Breaking3Security5Platform1New10Changed14Fixed14Other21

Full comparisonBack to omniauth
BreakingUpgrade verdict

3 breaking changes and a platform requirement change and 5 security fixes.

In plain terms
  • OmniAuth will no longer find constants from an ancestor class when looking for the strategy class.
  • OmniAuth will no longer throw errors if trying to run it in an app with RUBYOPT="--enable-frozen-string-literal".
  • Version 2.0 of OmniAuth includes some changes that may be breaking depending on how you use OmniAuth in your app.
  • You need at least Ruby 2.5 to install this version.
Must act Top 5 of 9 that need code or config changes

Ruby requirement changed in 2.2.0: >= 2.2 → >= 2.5.

What you must change

Breaking3
OmniAuth will no longer find constants from an ancestor class when looking for the strategy class.
::MyProviderOmniAuth::StrategiesMyProvider
2.0.0GitHub ReleaseOriginalView source
OmniAuth will no longer throw errors if trying to run it in an app with RUBYOPT="--enable-frozen-string-literal".
RUBYOPT="--enable-frozen-string-literal"
2.0.0GitHub ReleaseOriginalView source
Version 2.0 of OmniAuth includes some changes that may be breaking depending on how you use OmniAuth in your app.
2.0.0GitHub ReleaseOriginalView source
Security5
Guards against forged hosts in callback URLs via new OmniAuth.config.allowed_hosts, failing with invalid_host unless the request host matches.
OmniAuth.config.allowed_hostsfull_hostinvalid_host
2.2.0CHANGELOG.mdSummarizedView source
Runs request_validation_phase before writing omniauth.params to the session, so rejected cross-site POSTs cannot store attacker-controlled params.
request_validation_phaseomniauth.params
2.2.0CHANGELOG.mdSummarizedView source
Hopefully, you were already doing this as a result of the warnings due to CVE-2015-9284.
High · CVSS 8.8
2.0.0GitHub ReleaseOriginalView source
Because Rails handles its CSRF protection in its RequestForgeryProtection class, and stores tokens in a non-vanilla-rack friendly way, you must pass a rails-friendly validator in instead, similar to…
2.0.0GitHub ReleaseOriginalView source
OmniAuth's lib/omniauth/failure_endpoint.rb does not escape message_key value
Critical · CVSS 9.8
2.0.0GitHub AdvisoryOriginalView source
Platform1
Requires Ruby 2.5 or later (was 2.2).
2.2.0CHANGELOG.mdSummarizedView source