Intermittent CSRF Detected about omniauth-auth0 HOT 1 CLOSED

@robwise - Apologies for the delay here. That notice typically has to do with a missing state parameter. This all happens in the core OmniAuth library but a value is generated, stored in session, and sent to Auth0 in a URL parameter. Then, when the user hits the callback URL, the value that's returned from Auth0 is compared with the stored value.

If looks like your if authenticated_user.nil? clause is send the user to the login link, which should do the storage and redirect automatically. I can't see in the URL in the screenshot you posted but is there a state URL parameter? You'll want to check what's in session as well, it's most likely missing there for some reason.

I'm going to close this out for now since this is more on the parent library but please reply back if this looks more like a problem with our strategy. Again, apologies for the delay.

from omniauth-auth0.