omniauth: Rescue StandardError makes all development errors failures

Since bumping omniauth from 1.9.1 to 2.0.1 in our application all development errors have become failures. For example I purposefully introduce an error to a view. It is caught by omniauth and calls fail which means that we can no longer use better_errors to debug.

195:       rescue StandardError => e
    196:        binding.pry
 => 197:         return fail!(e.message, e)
    198:       end
    199: 
    200:       @app.call(env)
    201:     end

[1] pry(#<OmniAuth::Strategies::SAML>)> e
=> #<ActionView::Template::Error: undefined local variable or method `oops' for #<#<Class:0x00007f533c178068>:0x000055e0bcf640a8>>

Is there something that we misconfigured in omniauth setup? We catch the failures to give users a message in their browser https://github.com/ualbertalib/jupiter/blob/fe8409b9d4b4345e409c91a0cf6744b9ce4b91ba/config/initializers/omniauth.rb#L22 We can make this conditional based on environment but wondering if there is a better way?

https://github.com/omniauth/omniauth/blob/40e354c71094b663f928e1a987977690b67f2aa4/lib/omniauth/strategy.rb#L190-L197

About this issue

Original URL
State: closed
Created 3 years ago
Reactions: 2
Comments: 16 (8 by maintainers)

Most upvoted comments

Hi, I have the same problem. I use a omniauth-saml gem.

I found the omniauth-saml gem calls the call_app! method in the other_phase method. All errors have become failures and logs as “(saml) Authentication failure!” in the fail! method if an error occurs regardless of the auth process.

trysmr on Feb 2, 2021

Thanks for the report and additional information @trysmr, I think this is a bug in omniauth-saml and will release a patch for that gem.

BobbyMcWho on Feb 2, 2021

Yes. That’s effectively what we’ve done. We still think it’s strange that omniauth is intercepting all errors (not just the ones relevant to omniauth).

pgwillia on Jan 27, 2021