# Проблема CSRF в разработке с плагином 'Discourse OpenID Connect'

**URL:** <https://meta.discourse.org/t/csrf-problem-in-development-with-discourse-openid-connect-plug-in/282786>\
**Category:** Development\
**Created:** [19.Октябрь.2023 12:05:40 UTC](https://meta.discourse.org/t/csrf-problem-in-development-with-discourse-openid-connect-plug-in/282786 "2023-10-19T12:05:40Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![wayway\_way](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/wayway_way/32/327018_2.png) [@wayway\_way](https://meta.discourse.org/u/wayway_way)\
**Post date:** [19.Октябрь.2023 12:05:40 UTC](https://meta.discourse.org/t/csrf-problem-in-development-with-discourse-openid-connect-plug-in/282786/1 "2023-10-19T12:05:40Z")

</div>

Я потратил пять-шесть недель на настройку SSO в Discourse и столкнулся с рядом проблем в этот период. Сейчас возникла проблема, которая блокирует мою работу. Я постараюсь описать её максимально подробно.

# Среда разработки

- Ubuntu 22 на VMware
- [Discourse 3.2.0.beta2-dev](https://github.com/discourse/discourse/commits/cb8190d32f549b9f7f2d7642b80ac22fb151bf0b)
  - сервер работает на 127.0.0.1:3000
  - ember-cli работает на 127.0.0.1:4200
  - [Установка Discourse на Ubuntu или Debian для разработки](https://meta.discourse.org/t/install-discourse-on-ubuntu-or-debian-for-development/14727)
  - отключённые плагины:
    - presence
    - chat
    - narrative bot

  - Использование плагина [Discourse OpenID Connect](https://meta.discourse.org/t/discourse-openid-connect/103632) для подключения Keycloak на основе OIDC, где Keycloak выступает провайдером идентификации для Discourse
    - Настройка подключения OIDC в [Discourse OpenID Connect](https://meta.discourse.org/t/discourse-openid-connect/103632):
      - документ обнаружения OpenID Connect: `http://127.0.0.1:8080/realms/mediawiki-realm/.well-known/openid-configuration`
      - идентификатор клиента OpenID Connect: `mydiscourse`
      - секрет клиента OpenID Connect: `O9A8zQuOn1bfpsWD89U8ULwYf6ooDu73`

- Провайдер SSO: Keycloak 22.0.4
  - работает на 127.0.0.1:8080
  - Настройка подключения OIDC в Keycloak:
    - Допустимые URI перенаправления: `http://127.0.0.1:3000/auth/oidc/callback`
    - Секрет клиента: `O9A8zQuOn1bfpsWD89U8ULwYf6ooDu73`

- Браузер Chrome версии 118.0.5993.70

# Процесс воспроизведения

## Вход через OIDC

 ![image](https://global.discourse-cdn.com/meta/original/4X/2/1/c/21c32e7b66b7a0faa3263690657e35b90eef1dbb.png)

## Discourse перенаправляет на Keycloak, ввод данных пользователя в Keycloak

 ![image](https://global.discourse-cdn.com/meta/original/4X/2/b/6/2b66b31a4a32447e23b60d1e76801a32fd108d8e.jpeg)

## CSRF

 ![image](https://global.discourse-cdn.com/meta/original/4X/c/5/3/c537a5fe731a18bedebd6e53dc611e828a713d08.jpeg)

# Логи

 ![image](https://global.discourse-cdn.com/meta/original/4X/5/1/0/51035f86978b3f345a48f9e4b0486512c61e8de9.png)  
//  
 ![image](https://global.discourse-cdn.com/meta/original/4X/c/3/a/c3a331c8d4e32dbf692a71fd10ee37b8d61f34be.jpeg)  
//  
 ![image](https://global.discourse-cdn.com/meta/original/4X/9/e/7/9e79554a6f844d435cc1d62b6017964eda333653.jpeg)  
//  
 ![image](https://global.discourse-cdn.com/meta/original/4X/9/a/c/9acfb5476b7ef25cac9fd3072323669fa31ad0a3.png)  
// Трассировка приложения

```plaintext
lib/middleware/omniauth_bypass_middleware.rb:53:in `call'
lib/content_security_policy/middleware.rb:12:in `call'
lib/middleware/gtm_script_nonce_injector.rb:10:in `call'
config/initializers/100-quiet_logger.rb:20:in `call'
config/initializers/100-silence_logger.rb:29:in `call'
lib/middleware/missing_avatars.rb:22:in `call'
lib/middleware/turbo_dev.rb:31:in `call'

```

// Трассировка фреймворка

```plaintext
omniauth (1.9.2) lib/omniauth/failure_endpoint.rb:25:in `raise_out!'
omniauth (1.9.2) lib/omniauth/failure_endpoint.rb:20:in `call'
omniauth (1.9.2) lib/omniauth/failure_endpoint.rb:12:in `call'
omniauth (1.9.2) lib/omniauth/strategy.rb:491:in `fail!'
/home/hardway/Downloads/omniauth-oauth2/lib/omniauth/strategies/oauth2.rb:88:in `callback_phase'
plugins/discourse-openid-connect/lib/omniauth_open_id_connect.rb:142:in `callback_phase'
omniauth (1.9.2) lib/omniauth/strategy.rb:238:in `callback_call'
omniauth (1.9.2) lib/omniauth/strategy.rb:189:in `call!'
omniauth (1.9.2) lib/omniauth/strategy.rb:169:in `call'
omniauth (1.9.2) lib/omniauth/strategy.rb:192:in `call!'
omniauth (1.9.2) lib/omniauth/strategy.rb:169:in `call'
omniauth (1.9.2) lib/omniauth/strategy.rb:192:in `call!'
omniauth (1.9.2) lib/omniauth/strategy.rb:169:in `call'
omniauth (1.9.2) lib/omniauth/strategy.rb:192:in `call!'
omniauth (1.9.2) lib/omniauth/strategy.rb:169:in `call'
omniauth (1.9.2) lib/omniauth/strategy.rb:192:in `call!'
omniauth (1.9.2) lib/omniauth/strategy.rb:169:in `call'
omniauth (1.9.2) lib/omniauth/builder.rb:45:in `call'
rack (2.2.8) lib/rack/tempfile_reaper.rb:15:in `call'
rack (2.2.8) lib/rack/conditional_get.rb:27:in `call'
rack (2.2.8) lib/rack/head.rb:12:in `call'
actionpack (7.0.7) lib/action_dispatch/http/permissions_policy.rb:38:in `call'
rack (2.2.8) lib/rack/session/abstract/id.rb:266:in `context'
rack (2.2.8) lib/rack/session/abstract/id.rb:260:in `call'
actionpack (7.0.7) lib/action_dispatch/middleware/cookies.rb:704:in `call'
activerecord (7.0.7) lib/active_record/migration.rb:603:in `call'
actionpack (7.0.7) lib/action_dispatch/middleware/callbacks.rb:27:in `block in call'
activesupport (7.0.7) lib/active_support/callbacks.rb:99:in `run_callbacks'
actionpack (7.0.7) lib/action_dispatch/middleware/callbacks.rb:26:in `call'
actionpack (7.0.7) lib/action_dispatch/middleware/executor.rb:14:in `call'
actionpack (7.0.7) lib/action_dispatch/middleware/actionable_exceptions.rb:17:in `call'
actionpack (7.0.7) lib/action_dispatch/middleware/debug_exceptions.rb:28:in `call'
actionpack (7.0.7) lib/action_dispatch/middleware/show_exceptions.rb:29:in `call'
logster (2.13.0) lib/logster/middleware/reporter.rb:40:in `call'
railties (7.0.7) lib/rails/rack/logger.rb:40:in `call_app'
railties (7.0.7) lib/rails/rack/logger.rb:27:in `call'
actionpack (7.0.7) lib/action_dispatch/middleware/remote_ip.rb:93:in `call'
actionpack (7.0.7) lib/action_dispatch/middleware/request_id.rb:26:in `call'
rack (2.2.8) lib/rack/method_override.rb:24:in `call'
actionpack (7.0.7) lib/action_dispatch/middleware/executor.rb:14:in `call'
actionpack (7.0.7) lib/action_dispatch/middleware/static.rb:23:in `call'
rack (2.2.8) lib/rack/sendfile.rb:110:in `call'
actionpack (7.0.7) lib/action_dispatch/middleware/host_authorization.rb:137:in `call'
rack-mini-profiler (3.1.1) lib/mini_profiler.rb:413:in `call'
message_bus (4.3.8) lib/message_bus/rack/middleware.rb:60:in `call'
railties (7.0.7) lib/rails/engine.rb:530:in `call'
railties (7.0.7) lib/rails/railtie.rb:226:in `public_send'
railties (7.0.7) lib/rails/railtie.rb:226:in `method_missing'
rack (2.2.8) lib/rack/urlmap.rb:74:in `block in call'
rack (2.2.8) lib/rack/urlmap.rb:58:in `each'
rack (2.2.8) lib/rack/urlmap.rb:58:in `call'
unicorn (6.1.0) lib/unicorn/http_server.rb:634:in `process_client'
unicorn (6.1.0) lib/unicorn/http_server.rb:739:in `worker_loop'
unicorn (6.1.0) lib/unicorn/http_server.rb:547:in `spawn_missing_workers'
unicorn (6.1.0) lib/unicorn/http_server.rb:143:in `start'
unicorn (6.1.0) bin/unicorn:128:in `<top (required)>'
bin/unicorn:96:in `load'
bin/unicorn:96:in `block in <main>'
bin/unicorn:95:in `fork'
bin/unicorn:95:in `<main>'

```

// Полная трассировка

```plaintext
omniauth (1.9.2) lib/omniauth/failure_endpoint.rb:25:in `raise_out!'
omniauth (1.9.2) lib/omniauth/failure_endpoint.rb:20:in `call'
omniauth (1.9.2) lib/omniauth/failure_endpoint.rb:12:in `call'
omniauth (1.9.2) lib/omniauth/strategy.rb:491:in `fail!'
/home/hardway/Downloads/omniauth-oauth2/lib/omniauth/strategies/oauth2.rb:88:in `callback_phase'
plugins/discourse-openid-connect/lib/omniauth_open_id_connect.rb:142:in `callback_phase'
omniauth (1.9.2) lib/omniauth/strategy.rb:238:in `callback_call'
omniauth (1.9.2) lib/omniauth/strategy.rb:189:in `call!'
omniauth (1.9.2) lib/omniauth/strategy.rb:169:in `call'
omniauth (1.9.2) lib/omniauth/strategy.rb:192:in `call!'
omniauth (1.9.2) lib/omniauth/strategy.rb:169:in `call'
omniauth (1.9.2) lib/omniauth/strategy.rb:192:in `call!'
omniauth (1.9.2) lib/omniauth/strategy.rb:169:in `call'
omniauth (1.9.2) lib/omniauth/strategy.rb:192:in `call!'
omniauth (1.9.2) lib/omniauth/strategy.rb:169:in `call'
omniauth (1.9.2) lib/omniauth/strategy.rb:192:in `call!'
omniauth (1.9.2) lib/omniauth/strategy.rb:169:in `call'
omniauth (1.9.2) lib/omniauth/builder.rb:45:in `call'
lib/middleware/omniauth_bypass_middleware.rb:53:in `call'
rack (2.2.8) lib/rack/tempfile_reaper.rb:15:in `call'
rack (2.2.8) lib/rack/conditional_get.rb:27:in `call'
rack (2.2.8) lib/rack/head.rb:12:in `call'
actionpack (7.0.7) lib/action_dispatch/http/permissions_policy.rb:38:in `call'
lib/content_security_policy/middleware.rb:12:in `call'
lib/middleware/gtm_script_nonce_injector.rb:10:in `call'
rack (2.2.8) lib/rack/session/abstract/id.rb:266:in `context'
rack (2.2.8) lib/rack/session/abstract/id.rb:260:in `call'
actionpack (7.0.7) lib/action_dispatch/middleware/cookies.rb:704:in `call'
activerecord (7.0.7) lib/active_record/migration.rb:603:in `call'
actionpack (7.0.7) lib/action_dispatch/middleware/callbacks.rb:27:in `block in call'
activesupport (7.0.7) lib/active_support/callbacks.rb:99:in `run_callbacks'
actionpack (7.0.7) lib/action_dispatch/middleware/callbacks.rb:26:in `call'
actionpack (7.0.7) lib/action_dispatch/middleware/executor.rb:14:in `call'
actionpack (7.0.7) lib/action_dispatch/middleware/actionable_exceptions.rb:17:in `call'
actionpack (7.0.7) lib/action_dispatch/middleware/debug_exceptions.rb:28:in `call'
actionpack (7.0.7) lib/action_dispatch/middleware/show_exceptions.rb:29:in `call'
logster (2.13.0) lib/logster/middleware/reporter.rb:40:in `call'
railties (7.0.7) lib/rails/rack/logger.rb:40:in `call_app'
railties (7.0.7) lib/rails/rack/logger.rb:27:in `call'
config/initializers/100-quiet_logger.rb:20:in `call'
config/initializers/100-silence_logger.rb:29:in `call'
actionpack (7.0.7) lib/action_dispatch/middleware/remote_ip.rb:93:in `call'
actionpack (7.0.7) lib/action_dispatch/middleware/request_id.rb:26:in `call'
rack (2.2.8) lib/rack/method_override.rb:24:in `call'
actionpack (7.0.7) lib/action_dispatch/middleware/executor.rb:14:in `call'
actionpack (7.0.7) lib/action_dispatch/middleware/static.rb:23:in `call'
rack (2.2.8) lib/rack/sendfile.rb:110:in `call'
actionpack (7.0.7) lib/action_dispatch/middleware/host_authorization.rb:137:in `call'
lib/middleware/missing_avatars.rb:22:in `call'
lib/middleware/turbo_dev.rb:31:in `call'
rack-mini-profiler (3.1.1) lib/mini_profiler.rb:413:in `call'
message_bus (4.3.8) lib/message_bus/rack/middleware.rb:60:in `call'
railties (7.0.7) lib/rails/engine.rb:530:in `call'
railties (7.0.7) lib/rails/railtie.rb:226:in `public_send'
railties (7.0.7) lib/rails/railtie.rb:226:in `method_missing'
rack (2.2.8) lib/rack/urlmap.rb:74:in `block in call'
rack (2.2.8) lib/rack/urlmap.rb:58:in `each'
rack (2.2.8) lib/rack/urlmap.rb:58:in `call'
unicorn (6.1.0) lib/unicorn/http_server.rb:634:in `process_client'
unicorn (6.1.0) lib/unicorn/http_server.rb:739:in `worker_loop'
unicorn (6.1.0) lib/unicorn/http_server.rb:547:in `spawn_missing_workers'
unicorn (6.1.0) lib/unicorn/http_server.rb:143:in `start'
unicorn (6.1.0) bin/unicorn:128:in `<top (required)>'
bin/unicorn:96:in `load'
bin/unicorn:96:in `block in <main>'
bin/unicorn:95:in `fork'
bin/unicorn:95:in `<main>'

```

# Возможные причины

- [Discourse OpenID Connect (OIDC) - #257](https://meta.discourse.org/t/discourse-openid-connect/103632/257)
- [google\_oauth2 Authentication failure! csrf\_detected: OmniAuth::Strategies::OAuth2::CallbackError, csrf\_detected | CSRF detected · Issue #58 · omniauth/omniauth-oauth2 · GitHub](https://github.com/omniauth/omniauth-oauth2/issues/58#issuecomment-55061098)
- …

# Советы и рекомендации, которые я хотел бы получить

- Как работает аутентификация в Discourse?
- Как Discourse использует сессии?
- Механизм обмена сообщениями в Discourse
- Было бы отлично, если бы вы могли сразу сообщить решение проблемы

---

_[View the full topic](https://meta.discourse.org/t/csrf-problem-in-development-with-discourse-openid-connect-plug-in/282786)._