CSRF problem in development with 'Discourse OpenID Connect' plug-in

Possibly unrelated, but does setting the valid redirect URIs to http://127.0.0.1:4200/auth/oidc/callback make a difference?

Also, there’s currently something strange going on with the Ubuntu/Debian dev environment where the site can be accessed at either localhost:4200 or 127.0.0.1:4200. Each of those domains creates a separate session. Probably not related to your issue, but maybe something that could cause issues for local development. I always use the localhost:4200 domain. That seems to be what’s expected.

2 Likes