When we navigate out to a social auth method, we set the origin param on
that request to the value of the destination_url.
Upon returning to Discourse, that origin param is returned and [we use
it to
set](4dd3becec1/config/initializers/009-omniauth.rb (L24))
server_session["destination_url"].
Then during the [omniauth
callback](4dd3becec1/app/controllers/users/omniauth_callbacks_controller.rb (L43)),
we use the server_session["destination_url"] value to redirect back to
the page the destination_url cookie originally pointed to.
The problem is that in this scenario, the destination_url cookie never
gets deleted. This was causing a bug with Discourse ID in a corner case
where [the discourse-login plugin sets the destination_url
cookie](646e32f4a6/config/initializers/doorkeeper.rb (L38))
to a url that contains an OAuth state parameter which can become stale,
and the cookie keeps getting re-used for redirection but not deleted,
resulting in an error message "Sorry, the authorization timed out, or
you have switched browsers. Please try again." which the user can't
escape.
The solution is to make sure that when we return to the omniauth callback we always clean up both the server_session[:destination_url] and cookies[:destination_url]
aa157f5ea5
