# CSRF problem in development with 'Discourse OpenID Connect' plug-in **URL:** \ **Category:** Development\ **Created:** [October 19, 2023, 12:05pm UTC](https://meta.discourse.org/t/csrf-problem-in-development-with-discourse-openid-connect-plug-in/282786 "2023-10-19T12:05:40Z")\ **Posts on this page:** 1\ **Showing post:** 2
**Author:** ![simon](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/simon/32/339122_2.png) [@simon](https://meta.discourse.org/u/simon)\ **Post date:** [October 19, 2023, 7:34pm UTC](https://meta.discourse.org/t/csrf-problem-in-development-with-discourse-openid-connect-plug-in/282786/2 "2023-10-19T19:34:22Z")
> [@wayway\_way](#): > > OIDC connection configuration on keycloak > > - Valid redirect URIs: `http://127.0.0.1:3000/auth/oidc/callback` Possibly unrelated, but does setting the valid redirect URIs to `http://127.0.0.1:4200/auth/oidc/callback` make a difference? Also, there’s currently something strange going on with the Ubuntu/Debian dev environment where the site can be accessed at either `localhost:4200` or `127.0.0.1:4200`. Each of those domains creates a separate session. Probably not related to your issue, but maybe something that could cause issues for local development. I always use the `localhost:4200` domain. That seems to be what’s expected. --- _[View the full topic](https://meta.discourse.org/t/csrf-problem-in-development-with-discourse-openid-connect-plug-in/282786)._