Exception: OAuth2::CrossOriginRedirectError

Inherits:
Error
  • Object
show all
Defined in:
lib/oauth2/error.rb

Overview

Raised when a redirect to a different origin is refused.

The redirect target is attacker-influenced, so the message deliberately
omits the +Location+ value, and the redirect response body is never
parsed. The original response remains available via Error#response.

Constant Summary collapse

CODE =

Returns Stable machine-readable code for this error.

Returns:

  • (String) —

    Stable machine-readable code for this error

"cross_origin_redirect_blocked"
MESSAGE =

Returns Location-free, body-free refusal message.

Returns:

  • (String) —

    Location-free, body-free refusal message

"Refusing to follow cross-origin redirect. " \
"Set `allow_cross_origin_redirects: true` to permit cross-origin redirects, " \
"noting that request credentials (headers, body, and query parameters) " \
"may then be exposed to the redirect target."

Instance Attribute Summary

Attributes inherited from Error

#body, #code, #description, #response

Instance Method Summary collapse

Constructor Details

#initialize(response) ⇒ CrossOriginRedirectError

Returns a new instance of CrossOriginRedirectError.



97
98
99
100
101
102
103
104
 
# File 'lib/oauth2/error.rb', line 97

def initialize(response)
  # Pass nil so Error#initialize never parses the redirect response body.
  super(nil)
  @response = response
  @body = nil
  @code = CODE
  @description = "Cross-origin redirect refused (allow_cross_origin_redirects is false)."
end

Instance Method Details

#message ⇒ String

Returns Refusal message; never includes the redirect Location.

Returns:

  • (String) —

    Refusal message; never includes the redirect Location



107
108
109
 
# File 'lib/oauth2/error.rb', line 107

def message
  MESSAGE
end