Rails 3.2 + Facebook auth + CSRF FAILURE

Question

This is the error that I see when trying to login via facebook, I always see that error. Can't seem to get rid of it:

Could not authorize you from Facebook because "Csrf detected".

I put a skip:

skip_before_filter :verify_authenticity_token

on the Omniauth callback, but still I get the error. This is in both local and prod (heroku) environments. I have set the heroku environment variables. Any idea?

Answer 1

I had the same issue you have on the same day!! I thought it was a gem update or something like this but not at all. With a deep debugging I found that omniauth "Callback phase initiated." was called twice.

It was due to a stupid double initialization of

provider :facebook, .....

One in config/initializers/devise.rb and in another initializer.

I hope it will give you an hint to find your error

Answer 2

I found that the problem was the gem was too new and passing a STATE header to facebook, which fb didn't want. I rolled the omniauth-facebook gem version back and it worked