CSRF issue with API endpoint

2026-01-02 15:29:34 +11:00
parent f67a73821c
commit dd8bd15a76
1 changed files with 1 additions and 1 deletions
--- a/app/controllers/oidc_controller.rb
+++ b/app/controllers/oidc_controller.rb
@@ -1,7 +1,7 @@
 class OidcController < ApplicationController
  # Discovery and JWKS endpoints are public
  allow_unauthenticated_access only: [:discovery, :jwks, :token, :revoke, :userinfo, :logout]
-  skip_before_action :verify_authenticity_token, only: [:token, :revoke, :logout]
+  skip_before_action :verify_authenticity_token, only: [:token, :revoke, :userinfo, :logout]

  # Rate limiting to prevent brute force and abuse
  rate_limit to: 60, within: 1.minute, only: [:token, :revoke], with: -> {