An OmniAuth provider is configured with provider_ignores_state: true, which disables verification of the OAuth state parameter on the callback.

Why this matters

state is the OAuth CSRF defence: without it, an attacker can splice their own authorization code/response into a victim's session and complete a login/link they did not initiate (CWE-352). This flag exists only as an escape hatch and is a common LLM "fix" for state-mismatch errors caused by a broken session store.

Remove provider_ignores_state: true and fix the real cause (usually a session that is not shared between the request and callback phases, e.g. a cookie store misconfiguration or a load balancer without sticky sessions). Let OmniAuth validate state on every callback.

# frozen_string_literal: true

Rails.application.config.middleware.use OmniAuth::Builder do
  # ruleid: auth.ruby.oauth.omniauth-ignores-state
  provider :developer, provider_ignores_state: true
end

# ruleid: auth.ruby.oauth.omniauth-ignores-state
OMNIAUTH_OPTIONS = { 'provider_ignores_state' => true }.freeze

# frozen_string_literal: true

Rails.application.config.middleware.use OmniAuth::Builder do
  # State is validated (the default): the flag is explicitly false.
  provider :developer, provider_ignores_state: false
end

OMNIAUTH_OPTIONS = { 'provider_ignores_state' => false }.freeze

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.ruby.oauth.omniauth-ignores-state -- <reason>

References