use post request. #95

Gemfile

@@ -51,10 +51,11 @@ gem "gravtastic", "~> 3.2", ">= 3.2.6"
 gem "jwt", "~> 2.2", ">= 2.2.1"
 gem "mailgun-ruby", "~> 1.2"
 gem "oauth2", "~> 1.4"
-gem 'omniauth', '~> 2.0', '>= 2.0.4'
+gem "omniauth", "~> 2.0", ">= 2.0.4"
 gem "omniauth-github", "~> 2.0"
 gem "omniauth-globus", "~> 0.9.1"
 gem "omniauth-orcid", "~> 2.0"
+gem "omniauth-rails_csrf_protection", "~> 1.0"
 gem "validates_email_format_of", "~> 1.6", ">= 1.6.3"
 
 gem "apollo-federation", "~> 1.0"

Gemfile.lock

@@ -3,25 +3,25 @@ GEM
   specs:
     aasm (5.2.0)
       concurrent-ruby (~> 1.0)
-    actioncable (5.2.5)
-      actionpack (= 5.2.5)
+    actioncable (5.2.6)
+      actionpack (= 5.2.6)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailer (5.2.5)
-      actionpack (= 5.2.5)
-      actionview (= 5.2.5)
-      activejob (= 5.2.5)
+    actionmailer (5.2.6)
+      actionpack (= 5.2.6)
+      actionview (= 5.2.6)
+      activejob (= 5.2.6)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 2.0)
-    actionpack (5.2.5)
-      actionview (= 5.2.5)
-      activesupport (= 5.2.5)
+    actionpack (5.2.6)
+      actionview (= 5.2.6)
+      activesupport (= 5.2.6)
       rack (~> 2.0, >= 2.0.8)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (5.2.5)
-      activesupport (= 5.2.5)
+    actionview (5.2.6)
+      activesupport (= 5.2.6)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
@@ -31,20 +31,20 @@ GEM
       activemodel (>= 4.1, < 6.2)
       case_transform (>= 0.2)
       jsonapi-renderer (>= 0.1.1.beta1, < 0.3)
-    activejob (5.2.5)
-      activesupport (= 5.2.5)
+    activejob (5.2.6)
+      activesupport (= 5.2.6)
       globalid (>= 0.3.6)
-    activemodel (5.2.5)
-      activesupport (= 5.2.5)
-    activerecord (5.2.5)
-      activemodel (= 5.2.5)
-      activesupport (= 5.2.5)
+    activemodel (5.2.6)
+      activesupport (= 5.2.6)
+    activerecord (5.2.6)
+      activemodel (= 5.2.6)
+      activesupport (= 5.2.6)
       arel (>= 9.0)
-    activestorage (5.2.5)
-      actionpack (= 5.2.5)
-      activerecord (= 5.2.5)
+    activestorage (5.2.6)
+      actionpack (= 5.2.6)
+      activerecord (= 5.2.6)
       marcel (~> 1.0.0)
-    activesupport (5.2.5)
+    activesupport (5.2.6)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 0.7, < 2)
       minitest (~> 5.1)
@@ -59,7 +59,7 @@ GEM
     arel (9.0.0)
     ast (2.4.2)
     aws-eventstream (1.1.1)
-    aws-partitions (1.451.0)
+    aws-partitions (1.452.0)
     aws-sdk-core (3.114.0)
       aws-eventstream (~> 1, >= 1.0.2)
       aws-partitions (~> 1, >= 1.239.0)
@@ -449,6 +449,9 @@ GEM
     omniauth-orcid (2.1.1)
       omniauth-oauth2 (~> 1.3)
       ruby_dig (~> 0.0.2)
+    omniauth-rails_csrf_protection (1.0.0)
+      actionpack (>= 4.2)
+      omniauth (~> 2.0)
     optimist (3.0.1)
     orcid_client (0.8)
       activesupport (>= 4.2.5, < 6)
@@ -484,27 +487,27 @@ GEM
       rack (>= 1.0, < 3)
     rack-utf8_sanitizer (1.7.0)
       rack (>= 1.0, < 3.0)
-    rails (5.2.5)
-      actioncable (= 5.2.5)
-      actionmailer (= 5.2.5)
-      actionpack (= 5.2.5)
-      actionview (= 5.2.5)
-      activejob (= 5.2.5)
-      activemodel (= 5.2.5)
-      activerecord (= 5.2.5)
-      activestorage (= 5.2.5)
-      activesupport (= 5.2.5)
+    rails (5.2.6)
+      actioncable (= 5.2.6)
+      actionmailer (= 5.2.6)
+      actionpack (= 5.2.6)
+      actionview (= 5.2.6)
+      activejob (= 5.2.6)
+      activemodel (= 5.2.6)
+      activerecord (= 5.2.6)
+      activestorage (= 5.2.6)
+      activesupport (= 5.2.6)
       bundler (>= 1.3.0)
-      railties (= 5.2.5)
+      railties (= 5.2.6)
       sprockets-rails (>= 2.0.0)
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
     rails-html-sanitizer (1.3.0)
       loofah (~> 2.3)
-    railties (5.2.5)
-      actionpack (= 5.2.5)
-      activesupport (= 5.2.5)
+    railties (5.2.6)
+      actionpack (= 5.2.6)
+      activesupport (= 5.2.6)
       method_source
       rake (>= 0.8.7)
       thor (>= 0.19.0, < 2.0)
@@ -743,6 +746,7 @@ DEPENDENCIES
   omniauth-github (~> 2.0)
   omniauth-globus (~> 0.9.1)
   omniauth-orcid (~> 2.0)
+  omniauth-rails_csrf_protection (~> 1.0)
   orcid_client (~> 0.5, >= 0.8)
   postrank-uri (~> 1.0, >= 1.0.24)
   pwqgen.rb (~> 0.1.0)

app/views/users/sessions/new.html.erb

@@ -6,13 +6,13 @@
             <% if Rails.env.production? %>
               <div class="register-card-globus">
                 <h3 class="title">Sign In</h3>
-                <%= link_to "<img id=\"globus-logo\" src=\"#{ENV["CDN_URL"]}/images/globus.png\" alt=\"Globus icon\"/> Sign in with Globus".html_safe, user_globus_omniauth_authorize_path, :id => "sign-in-globus", class: 'btn btn-block btn-social btn-globus btn-fill' %>
+                <%= link_to "<img id=\"globus-logo\" src=\"#{ENV["CDN_URL"]}/images/globus.png\" alt=\"Globus icon\"/> Sign in with Globus".html_safe, user_globus_omniauth_authorize_path, method: :post, :id => "sign-in-globus", class: 'btn btn-block btn-social btn-globus btn-fill' %>
                 <p>Globus allows you to login via your institutional account (if supported), Google or ORCID. <a href="https://docs.globus.org/api/auth/specification/" target="_blank">Learn More</a></p>
               </div>
             <% else %>
               <div class="register-card-globus">
                 <h3 class="title">Sign In</h3>
-                <%= link_to "<img id=\"orcid-logo\" src=\"#{ENV["CDN_URL"]}/images/orcid.png\" alt=\"ORCID icon\"/>&nbsp;Sign in with ORCID".html_safe, user_orcid_omniauth_authorize_path, :id => "sign-in-orcid", class: 'btn btn-block btn-social btn-orcid btn-fill' %>
+                <%= link_to "<img id=\"orcid-logo\" src=\"#{ENV["CDN_URL"]}/images/orcid.png\" alt=\"ORCID icon\"/>&nbsp;Sign in with ORCID".html_safe, user_orcid_omniauth_authorize_path, method: :post, :id => "sign-in-orcid", class: 'btn btn-block btn-social btn-orcid btn-fill' %>
               </div>
             <% end %>
           </div>