We’ve overridden login.omniauth_error.csrf_detected to explicitly warn about iOS in-app browsers blocking cookies. Users who follow the instruction and retry in Safari succeed immediately, which further confirms this is a deterministic WKWebView limitation rather than a Discourse or IdP issue.
Thanks for reading through all of this.
At this point I’m mainly looking for confirmation from core maintainers that:
• OAuth/OIDC initiated inside iOS in-app browsers (Snapchat/Instagram/etc.) is not a supported or reliable flow
• and that csrf_detected failures in this context are expected and correctly handled by Discourse
If that’s the case, I’m happy to treat this as a documentation / UX messaging issue on my side rather than a bug.
If there’s any existing guidance I should be pointing users to (or if Discourse plans to improve the default error messaging here), I’d appreciate a pointer.