# CSRF problem in development with 'Discourse OpenID Connect' plug-in

**URL:** <https://meta.discourse.org/t/csrf-problem-in-development-with-discourse-openid-connect-plug-in/282786>\
**Category:** Development\
**Created:** [October 19, 2023, 12:05pm UTC](https://meta.discourse.org/t/csrf-problem-in-development-with-discourse-openid-connect-plug-in/282786 "2023-10-19T12:05:40Z")\
**Posts on this page:** 1\
**Showing post:** 8

<div class="post-metadata">

**Author:** ![simon](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/simon/32/339122_2.png) [@simon](https://meta.discourse.org/u/simon)\
**Post date:** [October 28, 2023, 7:34am UTC](https://meta.discourse.org/t/csrf-problem-in-development-with-discourse-openid-connect-plug-in/282786/8 "2023-10-28T07:34:25Z")

</div>

I’m not recommending it, but for local development I took the somewhat brutal approach of editing the plugin’s `callback_url` method: [discourse-openid-connect/lib/omniauth\_open\_id\_connect.rb at main · discourse/discourse-openid-connect · GitHub](https://github.com/discourse/discourse-openid-connect/blob/main/lib/omniauth_open_id_connect.rb#L218-L220).

```ruby
     def callback_url
        full_host = 'http://localhost:4200'
        full_host + script_name + callback_path
      end

```

That way it always returns `http://localhost:4200/auth/oidc/callback`

Without that change, I couldn’t find a way to get the host part of the URL set to anything other than `http://127.0.0.1:3000`

---

_[View the full topic](https://meta.discourse.org/t/csrf-problem-in-development-with-discourse-openid-connect-plug-in/282786)._