SECURITY: Add CSRF protections to OpenID callback

lib/auth/open_id_authenticator.rb

@@ -85,6 +85,19 @@ class Auth::OpenIdAuthenticator < Auth::Authenticator
          setup: lambda { |env|
            strategy = env["omniauth.strategy"]
            strategy.options[:store] = OpenID::Store::Redis.new($redis)
+
+           # Add CSRF protection in addition to OpenID Specification
+           def strategy.query_string
+              session["omniauth.state"] = state = SecureRandom.hex(24)
+             "?state=#{state}"
+           end
+
+           def strategy.callback_phase
+             stored_state = session.delete("omniauth.state")
+             provided_state = request.params["state"]
+             return fail!(:invalid_credentials) unless provided_state == stored_state
+             super
+           end
          },
          name: name,
          identifier: identifier,