# CSRF problem in development with 'Discourse OpenID Connect' plug-in

**URL:** <https://meta.discourse.org/t/csrf-problem-in-development-with-discourse-openid-connect-plug-in/282786>\
**Category:** Development\
**Created:** [October 19, 2023, 12:05pm UTC](https://meta.discourse.org/t/csrf-problem-in-development-with-discourse-openid-connect-plug-in/282786 "2023-10-19T12:05:40Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)\
**Post date:** [October 19, 2023, 10:17pm UTC](https://meta.discourse.org/t/csrf-problem-in-development-with-discourse-openid-connect-plug-in/282786/3 "2023-10-19T22:17:04Z")

</div>

> [@simon](#):
>
> does setting the valid redirect URIs to `http://127.0.0.1:4200/auth/oidc/callback` make a difference?

Yeah this would be my first thought as well. It’s important the authentication flow starts and ends on the same port, otherwise the session may be different.

If you boot Rails and Ember-CLI together via `bin/ember-cli -u`, then things should be automatically configured for you. But if you’re starting them separately, make sure you set the `DISCOURSE_PORT=4200` environment on the Rails server so that everything lines up correctly.

---

_[View the full topic](https://meta.discourse.org/t/csrf-problem-in-development-with-discourse-openid-connect-plug-in/282786)._