2.1.4 Does Not Work with Rails 7 Due to OmniAuth::AuthenticityTokenProtection
Author: sshawCreated Dec 4, 2025Updated Mar 6, 2026
Going through the Rails (Without Devise) Docs using the :developer provider. The docs instruct one to do the following:
gem 'omniauth'
gem "omniauth-rails_csrf_protection"But omniauth-rails_csrf_protection doc's state the following:
OmniAuth has provided a built-in solution to mitigate against CVE-2015-9284 since version 2.0.0. You should be able to mitigate against this vulnerability by adding this configuration to your application:
OmniAuth.config.request_validation_phase = OmniAuth::AuthenticityTokenProtection.new(key: :_csrf_token)
This gem will continued to be maintained as an alternative to the solution above.But removing omniauth-rails_csrf_protection and using AuthenticityTokenProtection as instructed results in the following error:
Started POST "/auth/developer" for ::1 at 2025-12-04 11:25:38 -0500
(developer) Request phase initiated.
Attack prevented by OmniAuth::AuthenticityTokenProtection
(developer) Authentication failure! authenticity_error: OmniAuth::AuthenticityError, Forbidden
(developer) Authentication failure! Forbidden: OmniAuth::AuthenticityError, Forbidden
OmniAuth::AuthenticityError (Forbidden):
omniauth (2.1.4) lib/omniauth/authenticity_token_protection.rb:27:in `deny'
rack-protection (4.2.1) lib/rack/protection/base.rb:57:in `react'
omniauth (2.1.4) lib/omniauth/authenticity_token_protection.rb:18:in `call!'
omniauth (2.1.4) lib/omniauth/strategy.rb:240:in `request_call'
omniauth (2.1.4) lib/omniauth/strategy.rb:193:in `call!'
omniauth (2.1.4) lib/omniauth/strategy.rb:169:in `call'
omniauth (2.1.4) lib/omniauth/builder.rb:48:in `call'
rack (3.1.19) lib/rack/tempfile_reaper.rb:20:in `call'
rack (3.1.19) lib/rack/etag.rb:29:in `call'
rack (3.1.19) lib/rack/conditional_get.rb:43:in `call'
rack (3.1.19) lib/rack/head.rb:15:in `call'
actionpack (7.2.2.2) lib/action_dispatch/http/permissions_policy.rb:38:in `call'
actionpack (7.2.2.2) lib/action_dispatch/http/content_security_policy.rb:38:in `call'
rack-session (2.1.1) lib/rack/session/abstract/id.rb:274:in `context'
rack-session (2.1.1) lib/rack/session/abstract/id.rb:268:in `call'
actionpack (7.2.2.2) lib/action_dispatch/middleware/cookies.rb:704:in `call'
activerecord (7.2.2.2) lib/active_record/migration.rb:674:in `call'
actionpack (7.2.2.2) lib/action_dispatch/middleware/callbacks.rb:31:in `block in call'
activesupport (7.2.2.2) lib/active_support/callbacks.rb:101:in `run_callbacks'
actionpack (7.2.2.2) lib/action_dispatch/middleware/callbacks.rb:30:in `call'
actionpack (7.2.2.2) lib/action_dispatch/middleware/executor.rb:16:in `call'
actionpack (7.2.2.2) lib/action_dispatch/middleware/actionable_exceptions.rb:18:in `call'
actionpack (7.2.2.2) lib/action_dispatch/middleware/debug_exceptions.rb:31:in `call'
web-console (4.2.1) lib/web_console/middleware.rb:132:in `call_app'
web-console (4.2.1) lib/web_console/middleware.rb:28:in `block in call'
web-console (4.2.1) lib/web_console/middleware.rb:17:in `catch'
web-console (4.2.1) lib/web_console/middleware.rb:17:in `call'
actionpack (7.2.2.2) lib/action_dispatch/middleware/show_exceptions.rb:32:in `call'
railties (7.2.2.2) lib/rails/rack/logger.rb:41:in `call_app'
railties (7.2.2.2) lib/rails/rack/logger.rb:29:in `call'
sprockets-rails (3.5.2) lib/sprockets/rails/quiet_assets.rb:17:in `call'
actionpack (7.2.2.2) lib/action_dispatch/middleware/remote_ip.rb:96:in `call'
actionpack (7.2.2.2) lib/action_dispatch/middleware/request_id.rb:33:in `call'
rack (3.1.19) lib/rack/method_override.rb:28:in `call'
rack (3.1.19) lib/rack/runtime.rb:24:in `call'
activesupport (7.2.2.2) lib/active_support/cache/strategy/local_cache_middleware.rb:29:in `call'
actionpack (7.2.2.2) lib/action_dispatch/middleware/server_timing.rb:61:in `block in call'
actionpack (7.2.2.2) lib/action_dispatch/middleware/server_timing.rb:26:in `collect_events'
actionpack (7.2.2.2) lib/action_dispatch/middleware/server_timing.rb:60:in `call'
actionpack (7.2.2.2) lib/action_dispatch/middleware/executor.rb:16:in `call'
actionpack (7.2.2.2) lib/action_dispatch/middleware/static.rb:27:in `call'
rack (3.1.19) lib/rack/sendfile.rb:131:in `call'
railties (7.2.2.2) lib/rails/engine.rb:535:in `call'
puma (7.1.0) lib/puma/configuration.rb:300:in `call'
puma (7.1.0) lib/puma/request.rb:101:in `block in handle_request'
puma (7.1.0) lib/puma/thread_pool.rb:355:in `with_force_shutdown'
puma (7.1.0) lib/puma/request.rb:100:in `handle_request'
puma (7.1.0) lib/puma/server.rb:503:in `process_client'
puma (7.1.0) lib/puma/server.rb:262:in `block in run'
puma (7.1.0) lib/puma/thread_pool.rb:182:in `block in spawn_thread'And using omniauth-rails_csrf_protection results in a similar error (except from its code).
Source: omniauth/omniauth