# CSRFTokenVerifier::InvalidCSRFToken when initiating SAML login on Discourse 2026.6

**URL:** https://meta.discourse.org/t/csrftokenverifier-invalidcsrftoken-when-initiating-saml-login-on-discourse-2026-6/406986
**Category:** SSO
**Tags:** saml
**Created:** [7 juli 2026 om 14:57 UTC](https://meta.discourse.org/t/csrftokenverifier-invalidcsrftoken-when-initiating-saml-login-on-discourse-2026-6/406986 "2026-07-07T14:57:12Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![Osman\_Nuri\_Mermer](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/osman_nuri_mermer/32/569838_2.png) [@Osman\_Nuri\_Mermer](https://meta.discourse.org/u/Osman_Nuri_Mermer)
#### Post date: [7 juli 2026 om 14:57 UTC](https://meta.discourse.org/t/csrftokenverifier-invalidcsrftoken-when-initiating-saml-login-on-discourse-2026-6/406986/1 "2026-07-07T14:57:12Z")

</div>

CSRFTokenVerifier::InvalidCSRFToken when initiating SAML login on Discourse 2026.6  
Hi,

I’m trying to configure SAML authentication with ADFS on a fresh Discourse installation.

### Environment

- Discourse version: 2026.6 (Rails 8.0.5)
- discourse-saml plugin
- Plugin commit:

```plaintext
7d0fe944bf33588e6813bffaef5eb8f34e37d039

```

- HTTPS enabled
- Reverse proxy / Load Balancer in front of Discourse
- force\_https = true

### SAML configuration

Metadata endpoint works correctly:

```plaintext
https://<hostname>/auth/saml/metadata

```

Metadata contains:

- EntityID
- ACS URL
- SLO URL

ADFS team successfully imported the metadata.

### Problem

When clicking **Login with SAML** , Discourse never redirects to ADFS.

Instead it immediately returns:

```plaintext
Sorry, the authorization timed out, or you have switched browsers.

```

### Rails log

```plaintext
Started GET "/session/csrf"
Completed 200 OK

Started POST "/auth/saml"

(saml) Authentication failure!
CSRFTokenVerifier::InvalidCSRFToken

Started GET "/auth/failure?message=csrf_detected&strategy=saml"

```

### Things already verified

- HTTPS works
- Discourse.base\_url = [https://hostname](https://hostname)
- force\_https = true
- Session cookie (\_forum\_session) exists
- authenticity\_token is included in POST /auth/saml
- discourse-saml plugin is latest main branch
- Metadata endpoint works
- ADFS metadata has been recreated from SP metadata

### Browser request

POST /auth/saml contains:

- \_forum\_session cookie
- authenticity\_token

However the request immediately fails with:

```plaintext
CSRFTokenVerifier::InvalidCSRFToken

```

It never reaches ADFS.

### Additional information

Browser DevTools shows:

```plaintext
x-csrf-token: undefined

```

Could this be a Rails 8 / OmniAuth CSRF issue, or is there another configuration required for discourse-saml on recent Discourse versions?

Any suggestions would be appreciated.

```plaintext

```

```plaintext
Discourse.base_url

https://testvknowyeni.vakifbank.intra

```

```plaintext

```

```plaintext
SiteSetting.force_https

true

```

```plaintext

```

```plaintext
SiteSetting.same_site_cookies

Lax

```