Issue: CSRF Detected Error with OAuth2 Login using oauth2-basic Plugin

Product Support SSO

AI-generated summary

A user reports a “csrf_detected” error when attempting OAuth2 login using the oauth2-basic plugin, where a curl request with an authenticity_token results in a 302 redirect to the failure page. The user is confused because they are not logged in and shouldn’t have a valid token. Ly_Chen asks whether this behavior is expected. supermathie suggests checking for a mismatch between browser and backend expectations and recommends enabling force_https to resolve the issue.

1

Hi,

I encountered a “csrf_detected” error while using the oauth2-basic plugin to log in via OAuth2. Below is the detailed flow of the issue:

  1. I click “Login,” which redirects me to:
    https://myforum/auth/basic_oauth2
  2. It then performs a 302 redirect to:
    https://myforum/auth/failure?message=csrf_detected

Reproduction Steps:

When I attempt to log in, the following curl command simulates the request:

curl -vvvv 'https://myforum/auth/oauth2_basic' \
  -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' \
  -H 'accept-language: zh-CN,zh;q=0.9' \
  -H 'cache-control: max-age=0' \
  -H 'content-type: application/x-www-form-urlencoded' \
  -H 'cookie: _forum_session=k9aHXc2cWsx%2FMBL26KTV33PSo8jC9Am47UBoT5Zq9qYAm2nKoU2BJkAR1bgc6U%2BYqsL3%2F3sjiYRmJoNr3JuvzkjdYl%2FjzT9djkq%2BYjSmN16EUEdZIdOl%2Fiv1MohQkthKSnOpUdXLTxHZBezxTg4O%2Bs6LUZ7HzCjpT3lxm24FS4xOPkU5QnSHBM%2F7GazZRhGywXsHKGdJ6fY0kVo%2BJHNNHBZu--qQKGn36Xh7jvKPEs--I1b3oz4nv2xe%2Fmi0bKPLog%3D%3D' \
  -H 'origin: https://myforum' \
  -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36' \
  --data-raw 'authenticity_token=doSNHEhj23HibAEZf0znqzevPNPq9Bub69Xnq18mKARw8GiGP-cokbg7k0qUvRgH3kayeJK7_-boeoOvX6GKqQ'

The result is a 302 redirect to the failure page with the message “csrf_detected”:

< HTTP/2 302 
< location: /auth/failure?message=csrf_detected

Findings:

  • If I omit the authenticity_token parameter, the login flow works correctly, and it redirects me to the OAuth2 login page as expected:

Question:

It seems that when the GET request to /auth/oauth2_basic includes an authenticity_token, the system checks it and throws the CSRF error if the token is invalid. But I’m confused—since I’m not logged in yet, how would I even have an authenticity_token at this stage?

Is this expected behavior, or is there an issue with how the CSRF token is being handled in the initial login process?

Any help or guidance would be appreciated!

Thank you!

2

We frequently see this error when there’s a mismatch between what the browser is using and what the backend is expecting.

Can you try turning on force_https and see if that fixes the problem?

If not, what’s your request path?