Sinatra app using omniauth gets Rack::Protection::SessionHijacking in ie9

internet-explorer, omniauth, rack, sinatra

Solution

This module tracks properties like USER_AGENT and similar (you can check them here: https://github.com/rkh/rack-protection/blob/master/lib/rack/protection/session_hijacking.rb). This error you get, is probably due the one of those properties are changed during the session. Try to test if everything works with just this module disabled:

set :protection, except: :session_hijacking

Problem

I have a Sinatra app, that uses omniauth which constantantly gets this error ``` attack prevented by Rack::Protection::SessionHijacking ``` when I try and log in (using a google account). It works fine in other versions of IE, and on chrome/firefox/safari. My setup is ``` rack (1.4.1) rack-force_domain (0.2.0) rack-protection (1.2.0) sinatra (1.3.2) rack (~> 1.3, >= 1.3.6) rack-protection (~> 1.2) tilt (~> 1.3, >= 1.3.3) omniauth (1.0.3) hashie (~> 1.2) rack omniauth-google-oauth2 (0.1.9) omniauth (~> 1.0) omniauth-oauth2 omniauth-oauth2 (1.0.0) oauth2 (~> 0.5.0) omniauth (~> 1.0) ``` Anyone know why this happens?

Original source