Use verify_authenticity_token directly

.github/workflows/tests.yml

@@ -73,7 +73,7 @@ jobs:
           - ruby: "3.1"
             rails: ~> 7.1.0
           - ruby: "3.1"
-            rails: edge
+            rails: ~> 7.2.0
 
           - ruby: "3.2"
             rails: ~> 6.0.0
@@ -83,6 +83,10 @@ jobs:
             rails: ~> 7.0.0
           - ruby: "3.2"
             rails: ~> 7.1.0
+          - ruby: "3.2"
+            rails: ~> 7.2.0
+          - ruby: "3.2"
+            rails: ~> 8.0.0
           - ruby: "3.2"
             rails: edge
 
@@ -94,6 +98,10 @@ jobs:
             rails: ~> 7.0.0
           - ruby: "3.3"
             rails: ~> 7.1.0
+          - ruby: "3.3"
+            rails: ~> 7.2.0
+          - ruby: "3.3"
+            rails: ~> 8.0.0
           - ruby: "3.3"
             rails: edge
 

lib/omniauth/rails_csrf_protection/token_verifier.rb

@@ -13,36 +13,49 @@ module RailsCsrfProtection
     # authenticity token, you can find the source code at
     # https://github.com/rails/rails/blob/v5.2.2/actionpack/lib/action_controller/metal/request_forgery_protection.rb#L217-L240.
     class TokenVerifier
+      # Inherits config from ActionController::Base.
+      # Define _before_ including ActionController::RequestForgeryProtection.
+      def self.config
+        @_config ||= ActionController::Base.config.inheritable_copy
+      end
+
       include ActiveSupport::Configurable
       include ActionController::RequestForgeryProtection
 
       # `ActionController::RequestForgeryProtection` contains a few
       # configurable options. As we want to make sure that our configuration is
       # the same as what being set in `ActionController::Base`, we should make
-      # all out configuration methods to delegate to `ActionController::Base`.
-      config.each_key do |configuration_name|
-        undef_method configuration_name
-        define_method configuration_name do
-          ActionController::Base.config[configuration_name]
-        end
-      end
+      # our configuration delegate to `ActionController::Base`.
+      config.each_key do |key| config.delete(key) end
+
+      # OmniAuth expects us to raise an exception on auth failure.
+      self.forgery_protection_strategy = protection_method_class(:exception)
+
+      # Logging from ActionController::RequestForgeryProtection is redundant.
+      # OmniAuth logs basically the same message (from the exception).
+      self.log_warning_on_csrf_failure = false
 
       def call(env)
         dup._call(env)
       end
 
       def _call(env)
         @request = ActionDispatch::Request.new(env.dup)
-
-        unless verified_request?
-          raise ActionController::InvalidAuthenticityToken
-        end
+        verify_authenticity_token
+      rescue ActionController::ActionControllerError => ex
+        logger.warn "Attack prevented by #{self.class}"
+        # wrapped exception:
+        # * rescued and handled by OmniAuth::Strategy#request_call
+        # * contains #cause with original exception
+        raise OmniAuth::AuthenticityError, "[#{ex.class}] #{ex}"
       end
 
       private
 
         attr_reader :request
         delegate :params, :session, to: :request
+
+        delegate :logger, to: OmniAuth
     end
   end
 end