title: OAuth2 error: CSRF Detected
body: <p>I'm using the ominauth-google-oauth2 gem in Rails. I Can't say that this is a bug but I am stumped on how to solve it. I've written a super simple Rails program to verify the problem. I am following <a href="https://medium.com/@ajayramesh/social-login-with-omniauth-and-rails-5-0-ad2bbd2a998e" rel="nofollow noreferrer">these instructions</a>.</p>
  
  <p>It seems that when I attempt to login to my gmail.com account, when I have other google oauth enabled accounts, I get this exception:</p>
  
  <pre><code>OmniAuth::Strategies::OAuth2::CallbackError at /auth/google_oauth2/callback
  csrf_detected | CSRF detected
  </code></pre>
  
  <p>Here's the top of the stack trace:</p>
  
  <pre><code>Started GET "/auth/google_oauth2/callback?state=732fc603c628199503f01781639123426e7fbfa874a36a4a&amp;code=4%2FF2VhN4EQfwYxr5cAmyp5S9sufuFMLP9Rpl-o85zWyyE" for 127.0.0.1 at 2017-10-16 12:01:03 -0400
  I, [2017-10-16T12:01:03.814169 #58394]  INFO -- omniauth: (google_oauth2) Callback phase initiated.
  E, [2017-10-16T12:01:03.814832 #58394] ERROR -- omniauth: (google_oauth2) Authentication failure! csrf_detected: OmniAuth::Strategies::OAuth2::CallbackError, csrf_detected | CSRF detected
  E, [2017-10-16T12:01:03.815656 #58394] ERROR -- omniauth: (google_oauth2) Authentication failure! invalid_credentials: OmniAuth::Strategies::OAuth2::CallbackError, csrf_detected | CSRF detected
  
  OmniAuth::Strategies::OAuth2::CallbackError - csrf_detected | CSRF detected:
    omniauth (1.7.1) lib/omniauth/failure_endpoint.rb:25:in `raise_out!'
    omniauth (1.7.1) lib/omniauth/failure_endpoint.rb:20:in `call'
    omniauth (1.7.1) lib/omniauth/failure_endpoint.rb:12:in `call'
    omniauth (1.7.1) lib/omniauth/strategy.rb:486:in `fail!'
    omniauth-oauth2 (1.4.0) lib/omniauth/strategies/oauth2.rb:71:in `callback_phase'
    omniauth (1.7.1) lib/omniauth/strategy.rb:236:in `callback_call'
    omniauth (1.7.1) lib/omniauth/strategy.rb:188:in `call!'
    omniauth (1.7.1) lib/omniauth/strategy.rb:168:in `call'
    omniauth (1.7.1) lib/omniauth/builder.rb:63:in `call'
    rack (2.0.3) lib/rack/etag.rb:25:in `call'
  </code></pre>
  
  <p>Here are all the relevant code snippets:</p>
  
  <h1>initializers/omniauth.rb</h1>
  
  <pre><code>Rails.application.config.middleware.use OmniAuth::Builder do
    provider :google_oauth2,
    "redacted",
    "redacted"
  end
  </code></pre>
  
  <h1>routes.rb</h1>
  
  <pre><code>get 'login', to: redirect('/auth/google_oauth2'), as: 'login'
  get 'logout', to: 'sessions#destroy', as: 'logout'
  get 'auth/:provider/callback', to: 'sessions#create'
  get 'auth/failure', to: redirect('/')
  get 'home', to: 'home#show'
  get 'me', to: 'me#show', as: 'me'
  </code></pre>
  
  <h1>views/home/show.html.erb</h1>
  
  <pre><code>&lt;%= link_to "Sign in with Google", "/auth/google_oauth2", id: "sign_in" %&gt;
  </code></pre>
  
  <h1>application_controller.rb</h1>
  
  <pre><code>class ApplicationController &lt; ActionController::Base
    protect_from_forgery with: :exception
  
    helper_method :current_user
  
    def authenticate
      redirect_to :login unless user_signed_in?
    end
  
    def current_user
      @current_user ||= User.find(session[:user_id]) if session[:user_id]
    end
  
    def user_signed_in?
      # converts current_user to a boolean by negating the negation
      !current_user.nil?
    end
  end
  </code></pre>
  
  <h1>sessions_controller.rb</h1>
  
  <pre><code>class SessionsController &lt; ApplicationController
    def create
      @user = User.find_or_create_from_auth_hash(request.env["omniauth.auth"])
      session[:user_id] = @user.id
      redirect_to :me
    end
  
    def destroy
      session[:user_id] = nil
      redirect_to root_path
    end
  end
  </code></pre>
  
  <ul>
  <li>I run the server with rails server -p 3000</li>
  <li>I access the page with <a href="http://localhost:3000" rel="nofollow noreferrer">http://localhost:3000</a></li>
  <li>This displays the page with the login button, which I press</li>
  <li>This displays a list of all my possible google logins (I think there are 4)</li>
  <li>I click on one of them, and I get the following exception: <code>
  </code>
  OmniAuth::Strategies::OAuth2::CallbackError at /auth/google_oauth2/callback
  csrf_detected | CSRF detected</li>
  </ul>
  
  <p>Stack trace is attached:</p>
  
  <p><img src="https://user-images.githubusercontent.com/44681/31585803-ebc8848c-b195-11e7-98aa-31407d7d4a5e.png" alt="screen shot 2017-10-15 at 10 44 21 am"></p>