doorkeeper-gem/doorkeeper — pull request #516 by phillbaker (2014-12-09 03:59:37+00:00)
Title: Add 'protect_from_forgery` to turn on Rail's built-in protection.

Since the Doorkeeper controllers inherit from Doorkeeper::Application (which inherits directly from ActionController::Base) and not ApplicationController, they never call `protect_from_forgery`, which means that non-GET methods don’t validate CSRF tokens. Thus, it’s possible for an attacker to host a form on an arbitrary URL, and if a users is logged into a site that uses Doorkeeper visits the URL, the attacker can grant access to a application on that site.