无法使用 Facebook 登录 Discourse ID

[dfabulich (Dan Fabulich)]

我在 macOS 26.1 上。我在 Chrome 142.0 中重现了此 bug，但在 Safari 26.1 中没有。

在 Chrome 开发者工具中，我看到以下内容，其中一些敏感部分（code 和 state 参数）已替换为 REDACTED：

• POST 到 https://id.discourse.com/auth/facebook
  • 302 重定向到 https://www.facebook.com/v5.0/dialog/oauth?client_id=1002152602034172&redirect_uri=https%3A%2F%2Fid.discourse.com%2Fauth%2Ffacebook%2Fcallback&response_type=code&scope=email&state=REDACTED
• GET 到 https://www.facebook.com/v5.0/dialog/oauth?client_id=1002152602034172&redirect_uri=https%3A%2F%2Fid.discourse.com%2Fauth%2Ffacebook%2Fcallback&response_type=code&scope=email&state=REDACTED
  • 302 重定向到 https://www.facebook.com/privacy/consent/gdp/?params[app_id]=1002152602034172&params[ios_fast_app_switch]=false&params[fblfb]=false&params[kid_directed_site]=false&params[blogger_id]="f4694485-7287-4d8b-b6fb-7b2e24a6eca0"&params[next]="confirm"&params[redirect_uri]="https%3A\%2F\%2Fid.discourse.com\%2Fauth\%2Ffacebook\%2Fcallback"&params[response_type]="code"&params[return_scopes]=false&params[scope]=["email"]&params[state]="REDACTED"&params[steps]={}&params[tp]="unspecified"&params[cui_gk]="[PASS]%3A"&params[is_limited_login_shim]=false&source=gdp_delegated&cache_buster=-2814008406871994827, 200 OK
• GET 到 https://www.facebook.com/dialog/consent/complete/?app_id=1002152602034172&close_uri=https%3A%2F%2Fid.discourse.com%2Fauth%2Ffacebook%2Fcallback%3Fcode%3DREDACTED%26state%3DREDACTED%23_%3D_&display=page&is_success_response=1&cache_buster=9053456441950167740&ext=1762813150&hash=AeRPfKHNpn86aMAA2Rk
  • 302 重定向到 https://id.discourse.com/auth/facebook/callback?code=REDACTED&state=REDACTED#_=*
• GET 到 https://id.discourse.com/auth/facebook/callback?code=REDACTED&state=REDACTED#_=*
  • 302 重定向到 https://id.discourse.com/oauth/authorize?client_id=w6frjy8zGCTX8HN5UoI20Jj0mMq3Z2cwPu-OJVExLbQ&redirect_uri=https%3A%2F%2Fmeta.discourse.org%2Fauth%2Fdiscourse_id%2Fcallback&response_type=code&scope=read&state=REDACTED
  • ^^ 注意这是“meta”出现的地方，来自 id.discourse.com 的响应头
• GET 到 https://id.discourse.com/oauth/authorize?client_id=w6frjy8zGCTX8HN5UoI20Jj0mMq3Z2cwPu-OJVExLbQ&redirect_uri=https%3A%2F%2Fmeta.discourse.org%2Fauth%2Fdiscourse_id%2Fcallback&response_type=code&scope=read&state=REDACTED
  • 302 重定向到 https://meta.discourse.org/auth/discourse_id/callback?code=REDACTED&state=REDACTED
• GET 到 https://meta.discourse.org/auth/discourse_id/callback?code=REDACTED&state=REDACTED
  • 302 重定向到 /auth/failure?message=csrf_detected&strategy=discourse_id

然后我最终到达 https://meta.discourse.org/auth/failure?message=csrf_detected&strategy=discourse_id 200 OK