Nonce mismatch Error about omniauth-apple HOT 10 CLOSED

set SameSite=none instead of redirect.

from omniauth-apple.

It reproduces if you store session in cookies.
Chrome browser doesn't send cookies on POST request from the Apple's site, so a new session is created by default.
A workaround is implemented in the link above:
1 Prevented the creation of a new session on a POST request
2 Redirected request to be sent to the same location with the same parameters. Since there is a GET request after the redirect, Chrome includes cookies in the request.

from omniauth-apple.

Just monkeypatch class OmniAuth::Strategies::Apple with the method callback_phase from the link

from omniauth-apple.

I'd prefer it to be merged into this gem, but it's up to maintainers.

from omniauth-apple.

Try this https://github.com/discourse/discourse-apple-auth/blob/40ef076fa744d562ce54f3f30921a1b387e042fb/lib/omniauth_apple.rb#L60

from omniauth-apple.

What causes this error?

from omniauth-apple.

Try this https://github.com/discourse/discourse-apple-auth/blob/40ef076fa744d562ce54f3f30921a1b387e042fb/lib/omniauth_apple.rb#L60

Where should I be implementing this solution? Bit stuck on this one..

from omniauth-apple.

Just monkeypatch class OmniAuth::Strategies::Apple with the method callback_phase from the link

Thanks! that did the trick

from omniauth-apple.

Thank you for all your work!

from omniauth-apple.

Instead of opening up the session to potential security risks, we may merge #107 and allow the nonce to be stored in its own encypted cookie?

from omniauth-apple.