Infrastructure/ghost
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2025-03-11 02:12:21 -05:00
Code Issues Activity

Fix the OAuth callback

Browse source 
https://github.com/TryGhost/Team/issues/614

By binding the user session to the Ghost instance domain
This commit is contained in:
Thibaut Patel 2021-05-21 10:49:55 +02:00
parent d08ea611b7
commit 1d5c8ccf2b
1 changed files with 2 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
core/server/web/oauth/app.js
View file

@ -128,9 +128,8 @@ module.exports = function setupOAuthApp() {
});
oauthApp.get('/:provider/callback', (req, res, next) => {
// Bypass CSRF protection to authenticate users as they are redirected from
// Google OAuth consent screen
res.locals.bypassCsrfProtection = true;
// Set the referrer as the ghost instance domain so that the session is linked to the ghost instance domain
req.headers.referrer = urlUtils.getSiteUrl();
next();
}, auth.authenticate.authenticateAdminApi, (req, res, next) => {
if (req.params.provider !== 'google') {