title: Rails - Strategies for avoiding OmniAuth and sharing computer risks
body: <p>While testing Omniauth and following the popular Ryan Bates' videos, I thought that there is a major security hole. Here is an example</p>
  
  <p>I have two users:
  Aurelien and John</p>
  
  <p>John in the morning logs in onto twitter but forgets to log out. Then he goes on myapplication and connects to the Twitter service through the <a href="http://myapplication.com/auth/twitter" rel="nofollow">http://myapplication.com/auth/twitter</a>. He is automatically assigned to a Twitter Authentication, because Twitter remembers that John was logged in. John goes to work. </p>
  
  <p>Meanwhile his brother Aurelien goes on the same computer and uses myapplication. He decides he wishes to post a Tweet from myapplication and continues to the <a href="http://myapplication.com/auth/twitter" rel="nofollow">http://myapplication.com/auth/twitter</a> to sign in into his Twitter account through OmniAuth. 
  What a surprise! he doesn't need to log in, but when redirected to the callback URL he discovers he is currently logged in as John!</p>
  
  <p>Nowadays I want to believe that the majority of users don't share their computer/table/phone, but I am sure this is a recurrent problem. </p>
  
  <p>What strategy or logic you could follow to prevent from this to happen? </p>
  
  <p>For instance, how can you make sure that when a different user from myapplication is required to login onto Twitter instead of using the session of Twitter that was previously open?</p>
  
  <p>Examples are welcome!</p>