Merge pull request #121 from faberge-eggs/SSRF-idref-fix

tobiashm · web-flow · commit d181a8a2099c · 2019-06-26T10:19:17.000+02:00
Avoid SSRF for claimed_id request
diff --git a/lib/openid/consumer/idres.rb b/lib/openid/consumer/idres.rb
@@ -72,9 +72,9 @@ def signed_fields
       def id_res
         check_for_fields
         verify_return_to
-        verify_discovery_results
         check_signature
         check_nonce
+        verify_discovery_results
       end
 
       def server_url
