# Can't login to Discourse ID with Facebook
**URL:** https://meta.discourse.org/t/cant-login-to-discourse-id-with-facebook/388065
**Category:** Support
**Tags:** discourse-id
**Created:** [10 november 2025 om 19:18 UTC](https://meta.discourse.org/t/cant-login-to-discourse-id-with-facebook/388065 "2025-11-10T19:18:27Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@dfabulich](https://meta.discourse.org/u/dfabulich)
#### Post date: [10 november 2025 om 19:18 UTC](https://meta.discourse.org/t/cant-login-to-discourse-id-with-facebook/388065/1 "2025-11-10T19:18:28Z")
I saw the banner on [meta.discourse.org](http://meta.discourse.org) saying that my Facebook social login would be removed, recommending that I switch to Discourse ID. So, I clicked the link to Discourse ID and tried Sign in with Facebook, and it failed.
It looks like your Facebook settings are incorrect. **Since login with Facebook doesn’t work yet, I think y’all should extend the November 30 deadline.**
> ## Feature Unavailable
>
> Facebook Login is currently unavailable for this app, since we are updating additional details for this app. Please try again later.
---
### Author:  [@pmusaraj](https://meta.discourse.org/u/pmusaraj)
#### Post date: [10 november 2025 om 19:47 UTC](https://meta.discourse.org/t/cant-login-to-discourse-id-with-facebook/388065/2 "2025-11-10T19:47:01Z")
Thanks for the report, Dan. I was able to log in using my Facebook account, but I see that App Review processes have changed, we need to provide some details on how we use Facebook’s AI. That is now done and we are waiting for review. Our Facebook app doesn’t do anything special, it only enables login via Facebook, but nonetheless, Meta (Facebook) needs to review. Hopefully they do this soon.
We will look into extending the deadline for this here on meta depending on how quickly that review goes through.
---
### Author:  [@dfabulich](https://meta.discourse.org/u/dfabulich)
#### Post date: [10 november 2025 om 19:51 UTC](https://meta.discourse.org/t/cant-login-to-discourse-id-with-facebook/388065/3 "2025-11-10T19:51:23Z")
A common gotcha with Facebook Login is that it will work for users who are listed on Facebook’s admin settings as “developers” of the Facebook app, but not work for the general public.
I believe you would be able to reproduce the problem by following Facebook’s guide to testing Facebook Login.
> **[Developer Platform](https://developers.facebook.com/documentation/facebook-login/guides/test)**
---
### Author:  [@pmusaraj](https://meta.discourse.org/u/pmusaraj)
#### Post date: [10 november 2025 om 19:55 UTC](https://meta.discourse.org/t/cant-login-to-discourse-id-with-facebook/388065/4 "2025-11-10T19:55:11Z")
Good suggestion, thank you. I just did that and logged in with a throwaway account (that isn’t admin or developer on the app). Saw this screen:
---
### Author:  [@dfabulich](https://meta.discourse.org/u/dfabulich)
#### Post date: [10 november 2025 om 22:10 UTC](https://meta.discourse.org/t/cant-login-to-discourse-id-with-facebook/388065/5 "2025-11-10T22:10:34Z")
It’s working a little bit better now, but still not quite working. I think you’ve set the redirect URL to the wrong URL.
To repro:
- Go to [id.discourse.com](http://id.discourse.com) (log out if you’re already logged in)
- Click “Log in” on the home page of [id.discourse.com](http://id.discourse.com)
- Click “Facebook”
- Now it prompts for name and email, or, if you’ve already logged in with Facebook, “You previously logged into Discourse Login (Discourse ID) with Facebook. Would you like to continue?”
- Click “Continue as [Name]”
- It redirects you to this page [https://meta.discourse.org/auth/failure?message=csrf\_detected&strategy=discourse\_id#\_=\_](https://meta.discourse.org/auth/failure?message=csrf_detected&strategy=discourse_id#_=_) on [meta.discourse.org](http://meta.discourse.org) (not [id.discourse.com](http://id.discourse.com))! which says, “Sorry, the authorization timed out, or you have switched browsers. Please try again.”
---
### Author:  [@pmusaraj](https://meta.discourse.org/u/pmusaraj)
#### Post date: [10 november 2025 om 22:14 UTC](https://meta.discourse.org/t/cant-login-to-discourse-id-with-facebook/388065/6 "2025-11-10T22:14:16Z")
If I follow those steps, I get sent to the homepage of [id.discourse.com](http://id.discourse.com), I _don’t_ get redirected to meta. I get logged in to ID and shown the ID homepage.
Unless, 🤔 there’s something lingering from a previous meta login attempt for you… Can you repro this on a different browser?
---
### Author:  [@dfabulich](https://meta.discourse.org/u/dfabulich)
#### Post date: [10 november 2025 om 22:28 UTC](https://meta.discourse.org/t/cant-login-to-discourse-id-with-facebook/388065/7 "2025-11-10T22:28:57Z")
I’m on macOS 26.1. I repro the bug in Chrome 142.0, but not in Safari 26.1.
In Chrome Dev Tools, here’s what I see, with a few sensitive bits (`code` and `state` parameters) replaced with `REDACTED` below:
- POST to [https://id.discourse.com/auth/facebook](https://id.discourse.com/auth/facebook)
- 302 redirect to [https://www.facebook.com/v5.0/dialog/oauth?client\_id=1002152602034172&redirect\_uri=https%3A%2F%2Fid.discourse.com%2Fauth%2Ffacebook%2Fcallback&response\_type=code&scope=email&state=REDACTED](https://www.facebook.com/v5.0/dialog/oauth?client_id=1002152602034172&redirect_uri=https%3A%2F%2Fid.discourse.com%2Fauth%2Ffacebook%2Fcallback&response_type=code&scope=email&state=REDACTED)
- GET to [https://www.facebook.com/v5.0/dialog/oauth?client\_id=1002152602034172&redirect\_uri=https%3A%2F%2Fid.discourse.com%2Fauth%2Ffacebook%2Fcallback&response\_type=code&scope=email&state=REDACTED](https://www.facebook.com/v5.0/dialog/oauth?client_id=1002152602034172&redirect_uri=https%3A%2F%2Fid.discourse.com%2Fauth%2Ffacebook%2Fcallback&response_type=code&scope=email&state=REDACTED)
- 302 redirect to [https://www.facebook.com/privacy/consent/gdp/?params[app\_id]=1002152602034172¶ms[ios\_fast\_app\_switch]=false¶ms[fblfb]=false¶ms[kid\_directed\_site]=false¶ms[logger\_id]="f4694485-7287-4d8b-b6fb-7b2e24a6eca0"¶ms[next]="confirm"¶ms[redirect\_uri]="https%3A\%2F\%2Fid.discourse.com\%2Fauth\%2Ffacebook\%2Fcallback"¶ms[response\_type]="code"¶ms[return\_scopes]=false¶ms[scope]=["email"]¶ms[state]="REDACTED"¶ms[steps]={}¶ms[tp]="unspecified"¶ms[cui\_gk]="[PASS]%3A"¶ms[is\_limited\_login\_shim]=false&source=gdp\_delegated&cache\_buster=-2814008406871994827](https://www.facebook.com/privacy/consent/gdp/?params%5Bapp_id%5D=1002152602034172¶ms%5Bios_fast_app_switch%5D=false¶ms%5Bfblfb%5D=false¶ms%5Bkid_directed_site%5D=false¶ms%5Blogger_id%5D=%22f4694485-7287-4d8b-b6fb-7b2e24a6eca0%22¶ms%5Bnext%5D=%22confirm%22¶ms%5Bredirect_uri%5D=%22https%3A%5C%2F%5C%2Fid.discourse.com%5C%2Fauth%5C%2Ffacebook%5C%2Fcallback%22¶ms%5Bresponse_type%5D=%22code%22¶ms%5Breturn_scopes%5D=false¶ms%5Bscope%5D=%5B%22email%22%5D¶ms%5Bstate%5D=%22REDACTED%22¶ms%5Bsteps%5D=%7B%7D¶ms%5Btp%5D=%22unspecified%22¶ms%5Bcui_gk%5D=%22%5BPASS%5D%3A%22¶ms%5Bis_limited_login_shim%5D=false&source=gdp_delegated&cache_buster=-2814008406871994827), 200 OK
- GET to [https://www.facebook.com/dialog/consent/complete/?app\_id=1002152602034172&close\_uri=https%3A%2F%2Fid.discourse.com%2Fauth%2Ffacebook%2Fcallback%3Fcode%3DREDACTED%26state%3DREDACTED%23\_%3D\_&display=page&is\_success\_response=1&cache\_buster=9053456441950167740&ext=1762813150&hash=AeRPfKHNpn86aMAA2Rk](https://www.facebook.com/dialog/consent/complete/?app_id=1002152602034172&close_uri=https%3A%2F%2Fid.discourse.com%2Fauth%2Ffacebook%2Fcallback%3Fcode%3DREDACTED%26state%3DREDACTED%23_%3D_&display=page&is_success_response=1&cache_buster=9053456441950167740&ext=1762813150&hash=AeRPfKHNpn86aMAA2Rk)
- 302 redirect to [https://id.discourse.com/auth/facebook/callback?code=REDACTED&state=REDACTED#\_=\_](https://id.discourse.com/auth/facebook/callback?code=REDACTED&state=REDACTED#_=_)
- GET to [https://id.discourse.com/auth/facebook/callback?code=REDACTED&state=REDACTED#\_=\_](https://id.discourse.com/auth/facebook/callback?code=REDACTED&state=REDACTED#_=_)
- 302 redirect to [https://id.discourse.com/oauth/authorize?client\_id=w6frjy8zGCTX8HN5UoI20Jj0mMq3Z2cwPu-OJVExLbQ&redirect\_uri=https%3A%2F%2Fmeta.discourse.org%2Fauth%2Fdiscourse\_id%2Fcallback&response\_type=code&scope=read&state=REDACTED](https://id.discourse.com/oauth/authorize?client_id=w6frjy8zGCTX8HN5UoI20Jj0mMq3Z2cwPu-OJVExLbQ&redirect_uri=https%3A%2F%2Fmeta.discourse.org%2Fauth%2Fdiscourse_id%2Fcallback&response_type=code&scope=read&state=REDACTED)
- **^^ note that this is where “meta” creeps in, from [id.discourse.com](http://id.discourse.com) response headers**
- GET to [https://id.discourse.com/oauth/authorize?client\_id=w6frjy8zGCTX8HN5UoI20Jj0mMq3Z2cwPu-OJVExLbQ&redirect\_uri=https%3A%2F%2Fmeta.discourse.org%2Fauth%2Fdiscourse\_id%2Fcallback&response\_type=code&scope=read&state=REDACTED](https://id.discourse.com/oauth/authorize?client_id=w6frjy8zGCTX8HN5UoI20Jj0mMq3Z2cwPu-OJVExLbQ&redirect_uri=https%3A%2F%2Fmeta.discourse.org%2Fauth%2Fdiscourse_id%2Fcallback&response_type=code&scope=read&state=REDACTED)
- 302 redirect to [https://meta.discourse.org/auth/discourse\_id/callback?code=REDACTED&state=REDACTED](https://meta.discourse.org/auth/discourse_id/callback?code=REDACTED&state=REDACTED)
- GET to [https://meta.discourse.org/auth/discourse\_id/callback?code=REDACTED&state=REDACTED](https://meta.discourse.org/auth/discourse_id/callback?code=REDACTED&state=REDACTED)
- 302 redirect to `/auth/failure?message=csrf_detected&strategy=discourse_id`
And then I end up at [https://meta.discourse.org/auth/failure?message=csrf\_detected&strategy=discourse\_id](https://meta.discourse.org/auth/failure?message=csrf_detected&strategy=discourse_id) 200 OK 🙄
---
### Author:  [@pmusaraj](https://meta.discourse.org/u/pmusaraj)
#### Post date: [10 november 2025 om 23:43 UTC](https://meta.discourse.org/t/cant-login-to-discourse-id-with-facebook/388065/9 "2025-11-10T23:43:28Z")
Thanks, I can reproduce under certain conditions, I think I can see what is happening.
When a user starts an authentication from meta, we store a value for `destination_url` on the ID instance so that after authentication, the user can be taken back to where they were. But when the authentication isn’t completed within a short amount of time (it fails or user abandons auth), that `destination_url` is not cleaned up, it stays in the user’s browser session. The next time the user tries to log in, ID tries to redirect to that URL, but since it has an old code/state combination from the original auth flow, the redirect results in the “Sorry, the authorization timed out” error.
It should not redirect at all after a short amount of time, we need to make sure that the `destination_url` value gets cleaned up after 10 mins, I believe the code/state combo for authentication is only valid for 10 minutes, need to double check.
---
### Author:  [@christo](https://meta.discourse.org/u/christo)
#### Post date: [25 november 2025 om 17:04 UTC](https://meta.discourse.org/t/cant-login-to-discourse-id-with-facebook/388065/23 "2025-11-25T17:04:36Z")
@dfabulich
This should be fixed as of this morning. We had a bug where users could hit that error based on a cookie with a stale authentication value, but we were failing to clear that cookie so the error would keep coming up.
Now if you happen to hit this error, you’ll see it once but the cookie that caused it will be cleared and the next time you log in you shouldn’t see it again.
---
### Author:  [@dfabulich](https://meta.discourse.org/u/dfabulich)
#### Post date: [25 november 2025 om 17:20 UTC](https://meta.discourse.org/t/cant-login-to-discourse-id-with-facebook/388065/24 "2025-11-25T17:20:58Z")
I successfully logged into [id.discourse.com](http://id.discourse.com) with Facebook! (But probably my cookie was long-since expired in any case.)
---
### Author:  [@christo](https://meta.discourse.org/u/christo)
#### Post date: [25 november 2025 om 17:26 UTC](https://meta.discourse.org/t/cant-login-to-discourse-id-with-facebook/388065/25 "2025-11-25T17:26:28Z")