OmniAuth is configured to accept GET requests on the request phase (allowed_request_methods includes :get, or silence_get_warning is set to true).

Why this matters

A GET auth-initiation URL can be triggered by any cross-site <img>/link, which lets an attacker start a login/account- link flow without the user's intent, a CSRF vector OmniAuth explicitly warns about (CWE-352). LLM-generated fixes often add :get (or silence the warning) to make a plain link work.

Keep the request phase POST-only: OmniAuth.config.allowed_request_methods = [:post], and initiate login with a real form/button that POSTs to /auth/:provider (or use the request-forgery-protection middleware). Do not silence the GET warning.

# frozen_string_literal: true

# ruleid: auth.ruby.oauth.omniauth-allows-get
OmniAuth.config.allowed_request_methods = [:get, :post]

# ruleid: auth.ruby.oauth.omniauth-allows-get
OmniAuth.config.allowed_request_methods = [:post, :get]

# ruleid: auth.ruby.oauth.omniauth-allows-get
OmniAuth.config.allowed_request_methods = [:get]

# ruleid: auth.ruby.oauth.omniauth-allows-get
OmniAuth.config.silence_get_warning = true

# frozen_string_literal: true

# POST-only request phase is the safe default.
OmniAuth.config.allowed_request_methods = [:post]

# The GET warning is left enabled.
OmniAuth.config.silence_get_warning = false

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.ruby.oauth.omniauth-allows-get -- <reason>

References