Omniauth custom provider and strategy w/ doorkeeper

Question

I have a custom OAuth2 provider (is a Rails app) built with Doorkeeper

and have a custom client strategy built with OmniAuth

The problem is when I set this in config/initializers/devise.rb

config.omniauth :mystrategy, "apikey", "secret"

Then i will got this error:

(mystrategy) Callback phase initiated.
(mystrategy) Authentication failure! invalid_credentials: 
OmniAuth::Strategies::OAuth2::CallbackError, OmniAuth::Strategies::OAuth2::CallbackError

And if i change the config in devise.rb to be

config.omniauth :mystrategy, "apikey", "secret", {:provider_ignores_state => true} 

Then everything is all right ...

I can't figure out what cause this problem. it seems the problem is the Rails' CSRF protection?

Answer 1

Try changing omniauth-oauth2 to version

gem "omniauth-oauth2", "~> 1.0.2"