undefined method `config' for OmniAuth:Module (NoMethodError)

[Bennie]

• Ruby versions tried: 2.7.4, 3.0.2
• Rails versions tried: 6.0.0, 6.1.4.1
• oauth2 version in Gemfile.lock: 1.4.7
• omniauth version in Gemfile.lock: 2.0.4
• omniauth-oauth2 version in Gemfile.lock: 1.7.1
• omniauth-rails_csrf_protection version in Gemfile.lock: 1.0.0

When I run any command through bin/rails (i.e. bin/rails s), I encounter the following error:

=> Booting Puma
=> Rails 6.1.4.1 application starting in development 
=> Run `bin/rails server --help` for more startup options
Exiting
/ruby/3.0.2/lib/ruby/gems/3.0.0/gems/omniauth-rails_csrf_protection-1.0.0/lib/omniauth/rails_csrf_protection/railtie.rb:7:in `block in <class:Railtie>': undefined method `config' for OmniAuth:Module (NoMethodError)
Did you mean?  concerning
        from /ruby/3.0.2/lib/ruby/gems/3.0.0/gems/railties-6.1.4.1/lib/rails/initializable.rb:32:in `instance_exec'
        from /ruby/3.0.2/lib/ruby/gems/3.0.0/gems/railties-6.1.4.1/lib/rails/initializable.rb:32:in `run'
        from /ruby/3.0.2/lib/ruby/gems/3.0.0/gems/railties-6.1.4.1/lib/rails/initializable.rb:61:in `block in run_initializers'
        from /ruby/3.0.2/lib/ruby/3.0.0/tsort.rb:228:in `block in tsort_each'
        from /ruby/3.0.2/lib/ruby/3.0.0/tsort.rb:350:in `block (2 levels) in each_strongly_connected_component'
        from /ruby/3.0.2/lib/ruby/3.0.0/tsort.rb:431:in `each_strongly_connected_component_from'
        from /ruby/3.0.2/lib/ruby/3.0.0/tsort.rb:349:in `block in each_strongly_connected_component'
        from /ruby/3.0.2/lib/ruby/3.0.0/tsort.rb:347:in `each'
        from /ruby/3.0.2/lib/ruby/3.0.0/tsort.rb:347:in `call'
        from /ruby/3.0.2/lib/ruby/3.0.0/tsort.rb:347:in `each_strongly_connected_component'
        from /ruby/3.0.2/lib/ruby/3.0.0/tsort.rb:226:in `tsort_each'
        from /ruby/3.0.2/lib/ruby/3.0.0/tsort.rb:205:in `tsort_each'
        from /ruby/3.0.2/lib/ruby/gems/3.0.0/gems/railties-6.1.4.1/lib/rails/initializable.rb:60:in `run_initializers'
        from /ruby/3.0.2/lib/ruby/gems/3.0.0/gems/railties-6.1.4.1/lib/rails/application.rb:391:in `initialize!

My current mitigation is to copy the TokenVerifier into config/initializers/omniauth.rb and configure as follows:

class TokenVerifier
  include ActiveSupport::Configurable
  include ActionController::RequestForgeryProtection

  config.each_key do |configuration_name|
    undef_method configuration_name
    define_method configuration_name do
      ActionController::Base.config[configuration_name]
    end
  end

  def call(env)
    @request = ActionDispatch::Request.new(env.dup)

    unless verified_request?
      raise ActionController::InvalidAuthenticityToken
    end
  end

  private

  attr_reader :request
  delegate :params, :session, to: :request
end

OmniAuth.config.request_validation_phase = TokenVerifier.new

Let me know if you need any additional details to recreate or diagnose

[Prem Sichanugrist]

Sorry, this issue fell through the crack. Let me take a look and get back to you.

[Alex Darr]

@sikachu I too am having this issue and appear to be totally stuck. Stubbing in the TokenVerifier class in /omniauth.rb does not appear to remedy the same error that @blrobin2 reported.

I'm running:

rails (6.1.4.1)
ruby (2.6.8)

omniauth-rails_csrf_protection (1.0.0)
omniauth (2.0.4)
omniauth-oauth2 (1.7.1)

[Akshay Birajdar]

I have created #13 as a possible fix for this issue.
@blrobin2 if possible can you test the fix in your codebase by using following:

gem 'omniauth-rails_csrf_protection', git: 'https://github.com/the-spectator/omniauth-rails_csrf_protection', branch: 'fix_missing'

cc: @sikachu

[Bennie]

@the-spectator I have tested by removing my mitigation and installing the gem as defined above, and I no longer get the reported error and am able to successfully authenticate

Let me know if you need any further details or testing on my end

[Akshay Birajdar]

Thank you for verifying the solution. 👍 @blrobin2

[Sam Clopton]

Thanks for the solution @the-spectator. Took a look at the PR, and it just adds a missing require "omniauth" :D. If one is looking to get past this error without relying on a specific and possibly temporary branch, they can just require "omniauth" in the application.rb file after Bundle.require.