Open ID Connect Troubleshooting

Product Support SSO

AI-generated summary

sports_dev is troubleshooting an OpenID Connect issue on a high-traffic self-hosted Discourse instance (forums.wholehogsports.com), using Auth0 for authentication and a third-party vendor for authorization. The problem is that the user’s email from Auth0 is not being written to the cookie, causing paid subscribers to hit a paywall. sports_dev suspects the issue began after upgrading to 2.9.0.beta2, has enabled logs but lacks experience interpreting them, and hasn’t yet reviewed the OpenID Connect discovery document. In response, Falco questions how the third-party vendor checks the cookie, warning that if Auth0 sets an HTTP-Only cookie (which JavaScript cannot access), a JS-based check will fail. sports_dev acknowledges unfamiliarity with HTTP-Only cookies and JS limitations, and seeks clarification. A follow-up post gently bumps the thread for further help, expressing openness to obvious fixes or guidance. The core issue appears to be a cookie visibility/access problem between Auth0, Discourse, and the third-party JS checker — possibly due to HTTP-Only restrictions or misconfigured claims/cookie handling post-upgrade.

1

Hello I’m working with a high-traffic self-hosted instance of Discourse.
It’s hosted on Digital Ocean. It uses the discourse-openid-connect plugin and Auth0 to do authentication.
For authorization we use a third-party vendor to check the cookies for the user’s email we’ve gotten from Auth0.
It seems that the email value is not getting written to the cookie. When our third-party authorization goes to check for the cookie, it’s not finding it. Our users get our paywall even though they are paid subscribers.
My question is how can I troubleshoot this to see where the problem lies?
I have:

  • Turned on the logs. But I don’t have the experience with the Open Id process to interpret the logs.
  • I haven’t made any changes to the plugin settings.
  • haven’t looked at the Open ID connect discovery document yet, I’m working on getting access to that soon.

These discourse forums have been running without problems for a long time. I haven’t made any changes to the plugins. I haven’t added/taken away anything.

I think this started happening after the 2.9.0.beta2 update.
You can see the forums here: forums.wholehogsports.com

Thank you for your time. Any suggestions would be helpful. I don’t have much experience with this so I appreciate any correction or clarification of my description.

2

How exactly this works? If Auth0 write an HTTP-Only and cookie that third party cookie check is in JS it won’t work.

3

Thank you for your response.
I’m still researching how our third-party checks for the email, but are you saying that it won’t work with Javascript.

And I’m not sure what you mean by HTTP-Only

I appreciate you taking time to respond. I’m new to discourse and our process. Thanks for your patience.

4

Just want to bump this to see if anyone might have a solution. Or maybe someone can show me something I’m obviously missing.