Merge pull request #1494 from sharelatex/spd-overleaf-v1-oauth-state

Use 'state' parameter to prefent CSRF attacks when authenticating with v1

GitOrigin-RevId: bf5f8ddffa391d8f3ca84d3588df906b08eb018d

services/web/app/coffee/Features/Authentication/AuthenticationController.coffee

@@ -75,6 +75,7 @@ module.exports = AuthenticationController =
 		)(req, res, next)
 
 	finishLogin: (user, req, res, next) ->
+		return res.redirect('/login') if user == false # OAuth2 'state' mismatch
 		redir = AuthenticationController._getRedirectFromSession(req) || "/project"
 		AuthenticationController._loginAsyncHandlers(req, user)
 		AuthenticationController.afterLoginSessionSetup req, user, (err) ->