CSRF Invalid Token / Error 422 on using OmniAuth Providers
Hey, just got a fresh install of GitLab through Omnibus yesterday.
I've been trying to have Single Sign-on with the rest of our Infra using OmniAuth providers, but it seems to always result in a 422 Error, and a CSRF invalid token in production.log.
This is similar to issues gitlab-ce#715 as well as gitlab-ce#331 and gitlab-ce#775 on omnibus-gitlab but their workarounds don't seem to apply :
- No reverse proxy other than Omnibus'
- Using embedded nginx
- I checked the generated nginx config, and X-forwarded-proto is set with $scheme for https accordingly (yet these headers don't seem to appear on the client side ?)
- Tried the workaround of using custom certificates, to no avail
- Tried to use HTTP-only, but this also results in a CSRF error
Spent a while trying to figure this out, looking in the sources for anything odd, but I'm at a loss. I'll probably try to fry the embedded nginx and experiment with my own, will give feedback then.