Merge pull request #11535 from neinteractiveliterature/fix/oauth-redirect-loop

Fix infinite redirect loop when signing in via third-party OAuth app

Author: nbudin

app/controllers/sessions_controller.rb

@@ -2,10 +2,10 @@
 class SessionsController < Devise::SessionsController
   include RedirectWithAuthentication
 
-  prepend_before_action :set_return_to, only: %i[new create]
+  prepend_before_action :set_return_to, only: [:new]
 
   def new
-    respond_to { |format| format.html { redirect_with_authentication('signIn') } }
+    respond_to { |format| format.html { redirect_with_authentication("signIn") } }
   end
 
   private

config/initializers/doorkeeper.rb

@@ -13,16 +13,7 @@ def id
   orm :active_record
 
   # This block will be called to check whether the resource owner is authenticated or not.
-  resource_owner_authenticator do
-    if user_signed_in?
-      current_user
-    else
-      # Redirect to login page, preserving the OAuth parameters
-      session[:user_return_to] = request.fullpath
-      redirect_to new_user_session_url
-      nil
-    end
-  end
+  resource_owner_authenticator { user_signed_in? ? current_user : NullResourceOwner.new }
 
   # If you didn't skip applications controller from Doorkeeper routes in your application routes.rb
   # file then you need to declare this block in order to restrict access to the web interface for