'
```
# Possible reason
- [Discourse OpenID Connect (OIDC) - #257](https://meta.discourse.org/t/discourse-openid-connect/103632/257)
- [google\_oauth2 Authentication failure! csrf\_detected: OmniAuth::Strategies::OAuth2::CallbackError, csrf\_detected | CSRF detected · Issue #58 · omniauth/omniauth-oauth2 · GitHub](https://github.com/omniauth/omniauth-oauth2/issues/58#issuecomment-55061098)
- …
# The guidance or tips I want to get
- How authentication in discourse works?
- How discourse uses session?
- Discourse messaging mechanism
- It would be best if you could tell me the solution directly
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [October 19, 2023, 7:34pm UTC](https://meta.discourse.org/t/csrf-problem-in-development-with-discourse-openid-connect-plug-in/282786/2 "2023-10-19T19:34:22Z")
> [@wayway\_way](#):
>
> OIDC connection configuration on keycloak
>
> - Valid redirect URIs: `http://127.0.0.1:3000/auth/oidc/callback`
Possibly unrelated, but does setting the valid redirect URIs to `http://127.0.0.1:4200/auth/oidc/callback` make a difference?
Also, there’s currently something strange going on with the Ubuntu/Debian dev environment where the site can be accessed at either `localhost:4200` or `127.0.0.1:4200`. Each of those domains creates a separate session. Probably not related to your issue, but maybe something that could cause issues for local development. I always use the `localhost:4200` domain. That seems to be what’s expected.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [October 19, 2023, 10:17pm UTC](https://meta.discourse.org/t/csrf-problem-in-development-with-discourse-openid-connect-plug-in/282786/3 "2023-10-19T22:17:04Z")
> [@simon](#):
>
> does setting the valid redirect URIs to `http://127.0.0.1:4200/auth/oidc/callback` make a difference?
Yeah this would be my first thought as well. It’s important the authentication flow starts and ends on the same port, otherwise the session may be different.
If you boot Rails and Ember-CLI together via `bin/ember-cli -u`, then things should be automatically configured for you. But if you’re starting them separately, make sure you set the `DISCOURSE_PORT=4200` environment on the Rails server so that everything lines up correctly.
---
### Author:  [@wayway\_way](https://meta.discourse.org/u/wayway_way)
#### Post date: [October 20, 2023, 3:57am UTC](https://meta.discourse.org/t/csrf-problem-in-development-with-discourse-openid-connect-plug-in/282786/4 "2023-10-20T03:57:11Z")
I tried, but “Invalid parameter: redirect\_uri” appears in Keycloak.
Boot Rails and Ember-CLI together via `bin/ember-cli -u`
Set the valid redirect URIs to `http://127.0.0.1:4200/auth/oidc/callback`.
---
### Author:  [@wayway\_way](https://meta.discourse.org/u/wayway_way)
#### Post date: [October 20, 2023, 6:57am UTC](https://meta.discourse.org/t/csrf-problem-in-development-with-discourse-openid-connect-plug-in/282786/5 "2023-10-20T06:57:56Z")
It appears that the cause is a discrepancy between the valid redirect URIs in Keycloak and the URIs depicted in the following illustration.
> [@wayway\_way](#):
>
> 
>
> image1920×901 145 KB
The URI depicted within the image is
```plaintext
http://127.0.0.1:8080/realms/mediawiki-realm/protocol/openid-connect/auth?client_id=mydiscourse&nonce=dce3dd8bccb09b25f88d1645d26b9d20b58e3d2ff3804f83ed79098c793a5ae2&redirect_uri=http%3A%2F%2F127.0.0.1%3A3000%2Fauth%2Foidc%2Fcallback&response_type=code&scope=openid+profile+email&state=7fd712dd2b28c8264eac170721b898b26ae8fb2edb9a2e9f
```
Upon decoding the ‘redirect\_uri’, its equivalence to
```plaintext
http://127.0.0.1:3000/auth/oidc/callback
```
What, indeed, ought to be the correct redirect\_uri?
---
### Author:  [@wayway\_way](https://meta.discourse.org/u/wayway_way)
#### Post date: [October 20, 2023, 2:07pm UTC](https://meta.discourse.org/t/csrf-problem-in-development-with-discourse-openid-connect-plug-in/282786/6 "2023-10-20T14:07:41Z")
Would you be so kind as to divulge the platform utilized for identity verification during the creation of this plugin?
---
### Author:  [@wayway\_way](https://meta.discourse.org/u/wayway_way)
#### Post date: [October 23, 2023, 3:25am UTC](https://meta.discourse.org/t/csrf-problem-in-development-with-discourse-openid-connect-plug-in/282786/7 "2023-10-23T03:25:25Z")
> [@simon](#):
>
> Probably not related to your issue, but maybe something that could cause issues for local development. I always use the `localhost:4200` domain. That seems to be what’s expected
Thanks, it works. 😊
My workaround was to open discourse using 127.0.0.1:4200 instead of localhost:4200
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [October 28, 2023, 7:34am UTC](https://meta.discourse.org/t/csrf-problem-in-development-with-discourse-openid-connect-plug-in/282786/8 "2023-10-28T07:34:25Z")
I’m not recommending it, but for local development I took the somewhat brutal approach of editing the plugin’s `callback_url` method: [discourse-openid-connect/lib/omniauth\_open\_id\_connect.rb at main · discourse/discourse-openid-connect · GitHub](https://github.com/discourse/discourse-openid-connect/blob/main/lib/omniauth_open_id_connect.rb#L218-L220).
```ruby
def callback_url
full_host = 'http://localhost:4200'
full_host + script_name + callback_path
end
```
That way it always returns `http://localhost:4200/auth/oidc/callback`
Without that change, I couldn’t find a way to get the host part of the URL set to anything other than `http://127.0.0.1:3000`
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [November 27, 2023, 7:34am UTC](https://meta.discourse.org/t/csrf-problem-in-development-with-discourse-openid-connect-plug-in/282786/9 "2023-11-27T07:34:41Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.