# Connect SSO: Login Error sso\_login

**URL:** <https://meta.discourse.org/t/connect-sso-login-error-sso-login/309413>\
**Category:** SSO\
**Created:** [May 25, 2024, 11:20pm UTC](https://meta.discourse.org/t/connect-sso-login-error-sso-login/309413 "2024-05-25T23:20:03Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![BrainFried](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/brainfried/32/388499_2.png) [@BrainFried](https://meta.discourse.org/u/BrainFried)\
**Post date:** [May 25, 2024, 11:20pm UTC](https://meta.discourse.org/t/connect-sso-login-error-sso-login/309413/1 "2024-05-25T23:20:03Z")

</div>

I’ve done a few hours of research for my issue and I think I’m close, but might need a little nudge in the right direction.

I’m essentially trying to integrate Discourse as headless implementation into my react project which already contains authenticated users in it’s own DB.

To do this, when the user logs in on the React page, it will perform a SSO for the user to authenticate with the Discourse API so that we can call the appropriate functions and such.

So, I’m first first fetching from my Discourse URL and preventing any redirects like so:

```plaintext
const response = await fetch('https://forum.mysite.com/session/sso', {
    method: 'GET',
    redirect: 'manual', // Prevent automatic following of redirects
  });

```

Then I do the whole validation shin-diggy and send the Payload with the user information to the backend using:

```plaintext
const loginResponse = await fetch(newurl.toString(), {
    method: 'GET',
    headers: {
      'Content-Type': 'application/x-www-form-urlencoded',
    },
    redirect: 'manual',
  });

```

And the formatting and Signature and such all look good. But it gives me an error. So I commented this out, and took the generated URL and copied it my browser to see what’s up and it gives me this:

 ![image](https://global.discourse-cdn.com/meta/original/4X/f/1/3/f137f08559d26cb806ff2384ededddf40e30fdeb.png)

```plaintext
Verbose SSO log: Nonce is incorrect, was generated in a different browser session, or has expired add_groups: admin: avatar_force_update: avatar_url: bio: card_background_url: confirmed_2fa: e 

```

So after a bit of researching I think these answers are close to helping me but I’m still not very clear on what to change for my setup and force\_https doesn’t seem to be a setting we can manipulate anymore (not even sure what it does):

> [@SSO incorrect nonce](https://meta.discourse.org/t/sso-incorrect-nonce/228925/3):
>
> I currently have this exact same problem

> [@403 Error when changing any settings after enabling force\_https with proxy](https://meta.discourse.org/t/403-error-when-changing-any-settings-after-enabling-force-https-with-proxy/132246/4):
>
> I think you are not passing the https through correctly. Search here for solutions.

I feel like it’s possibly caused by different browsers session, but idk. I think I’m close to getting this to work though, I just need a little nudge. Any info would be helpful. Thanks!

---

_[View the full topic](https://meta.discourse.org/t/connect-sso-login-error-sso-login/309413)._