Really weird CSRF issue...

[bill-transue]

Hi, I'm getting csrf_detected and having trouble figuring out where I'm going wrong. I monkey patched the Google strategy directly in the config/initializers/omniauth.rb because by the time my initializer is ran the Omniauth::Strategies::GoogleOauth2 has already inherited OmniAuth::Strategies::OAuth2.

module OmniAuth
  module Strategies
    class GoogleOauth2
      def callback_phase # rubocop:disable AbcSize, CyclomaticComplexity, MethodLength, PerceivedComplexity
        Rails.logger.warn '------------------------------------'
        Rails.logger.warn '------------------------------------'
        Rails.logger.warn "request.params['state'].class.name = #{request.params['state'].class.name}"
        Rails.logger.warn "request.params['state'] = #{request.params['state']}"
        Rails.logger.warn "request.params['state'].inspect = #{request.params['state'].inspect}"
        Rails.logger.warn "session['omniauth.state'].class.name = #{session['omniauth.state'].class.name}"
        Rails.logger.warn "session['omniauth.state'] = #{session['omniauth.state']}"
        Rails.logger.warn "session['omniauth.state'].inspect = #{session['omniauth.state'].inspect}"
        Rails.logger.warn "equality: #{request.params["state"] == session["omniauth.state"]}"
        Rails.logger.warn "inequality: #{request.params["state"] != session["omniauth.state"]}"
        Rails.logger.warn '------------------------------------'
        Rails.logger.warn '------------------------------------'

        error = request.params["error_reason"] || request.params["error"]
        if error
          fail!(error, CallbackError.new(request.params["error"], request.params["error_description"] || request.params["error_reason"], request.params["error_uri"]))
        elsif !options.provider_ignores_state && (request.params["state"].to_s.empty? || request.params["state"] != session.delete("omniauth.state"))
          Rails.logger.warn "i've failed"
          fail!(:csrf_detected, CallbackError.new(:csrf_detected, "CSRF detected"))
        else
          self.access_token = build_access_token
          self.access_token = access_token.refresh! if access_token.expired?
          super
        end
      rescue ::OAuth2::Error, CallbackError => e
        fail!(:invalid_credentials, e)
      rescue ::Timeout::Error, ::Errno::ETIMEDOUT => e
        fail!(:timeout, e)
      rescue ::SocketError => e
        fail!(:failed_to_connect, e)
      end
    end
  end
end

Please note the Rails.logger.warn "i've failed" line, I see it when the state tokens don't match.
I call this the bad but good scenario.

What confuses me is when the state tokens match but I still get the csrf detected, but I don't see the "i've failed" message. I call this the good but bad scenario.

Any help figuring out what's going on here would be much appreciated.