OAuth integration basics in Ruby on Rails - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens after successful OAuth callback in Rails?

In a Rails app using OAuth, after the user authorizes the app and the OAuth provider redirects back, what is the typical next step in the controller handling the callback?

A The app sends an email to the user asking to confirm the OAuth authorization.

B The app immediately redirects the user to the OAuth provider's homepage.

C The app deletes the user session and logs the user out.

D The app exchanges the received code for an access token and creates or updates the user session.

💡 Hint

Think about what the app needs to do to get permission to act on the user's behalf.

After OAuth provider redirects back with a code, the app must exchange it for an access token to authenticate the user and create or update the session.

📝 Syntax

intermediate

Identify the correct OmniAuth middleware setup in Rails

Which of the following is the correct way to configure OmniAuth middleware for GitHub OAuth in a Rails app's config/initializers/omniauth.rb?

A

Rails.middleware.use OmniAuth::Builder do
  provider :github, ENV['GITHUB_KEY'], ENV['GITHUB_SECRET']
end

B

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :github, ENV['GITHUB_KEY'], ENV['GITHUB_SECRET']
end

C

Rails.application.config.middleware.add OmniAuth::Builder do
  provider :github, ENV['GITHUB_KEY'], ENV['GITHUB_SECRET']
end

D

Rails.application.middleware.use OmniAuth::Builder do
  provider :github, ENV['GITHUB_KEY'], ENV['GITHUB_SECRET']
end

💡 Hint

Check the exact method to add middleware in Rails application config.

The correct syntax uses Rails.application.config.middleware.use to add OmniAuth::Builder with the provider block.

🔧 Debug

advanced

Why does the OAuth callback fail with 'invalid redirect_uri' error?

A Rails app using OAuth gets an 'invalid redirect_uri' error from the provider during callback. What is the most likely cause?

A The redirect_uri sent in the OAuth request does not exactly match the one registered in the OAuth provider settings.

B The OAuth client ID is missing from the request parameters.

C The user denied the OAuth authorization request.

D The Rails app is missing the CSRF token in the callback request.

💡 Hint

OAuth providers require exact URL matches for security.

OAuth providers check that the redirect_uri in the request matches exactly what was registered to prevent malicious redirects.

❓ state_output

advanced

What is stored in session after OAuth login?

After a successful OAuth login in a Rails app, which of the following is the most common data stored in the session?

A The user's OAuth access token and refresh token in plain text.

B The entire OAuth response hash including sensitive tokens.

C The user's unique ID or user record ID to identify the logged-in user.

D The user's password in encrypted form.

💡 Hint

Think about what minimal info is needed to keep the user logged in securely.

Storing only the user ID in session is secure and sufficient to identify the user; tokens are usually stored encrypted in the database if needed.

🧠 Conceptual

expert

Why use OAuth scopes in integration?

In OAuth integration, why do apps request specific scopes during authorization?

A To limit the app's access to only the permissions it needs, enhancing user trust and security.

B To speed up the OAuth authorization process by skipping user consent.

C To allow the app to access all user data without restrictions.

D To automatically refresh the access token without user interaction.

💡 Hint

Think about why apps ask for permission to access only some data, not everything.

Scopes define what data or actions the app can access, helping users control their privacy and limiting app permissions.