socialcast/devise_oauth2_providable — pull request #44 by dvdplm (2012-07-23 09:48:43+00:00)
Title: CSRF protection: "state" param

Currently 'rack-oauth2' passes the "state" param when provided but the devise front-end does not. This exposes users to CSRF attacks as outlined here: http://homakov.blogspot.it/2012/07/saferweb-most-common-oauth2.html

The Oauth2 draft strongly advices clients to make use of the "state" param: http://tools.ietf.org/html/draft-ietf-oauth-v2-27#section-10.12

This PR sets the `@state` ivar and includes it in the allow/deny form.