# Discourse Cookie Store: Omniauth callback sessions are nil
**URL:** https://meta.discourse.org/t/discourse-cookie-store-omniauth-callback-sessions-are-nil/58096
**Category:** Bug
**Created:** [28 februari 2017 om 15:45 UTC](https://meta.discourse.org/t/discourse-cookie-store-omniauth-callback-sessions-are-nil/58096 "2017-02-28T15:45:14Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@leo.proctor](https://meta.discourse.org/u/leo.proctor)
#### Post date: [28 februari 2017 om 15:45 UTC](https://meta.discourse.org/t/discourse-cookie-store-omniauth-callback-sessions-are-nil/58096/1 "2017-02-28T15:45:14Z")
In my custom oauth2 login I’m saving some session values. It was working fine till I recently pulled the latest code from branch `tests-passed` and noticed that `session` is always nil in omniauth\_callback\_controller.rb
> def complete
> auth = request.env[“omniauth.auth”]
> auth[:session] = session # it doesn’t contain my session value
Then i found out session\_store was changed in latest pull
> Discourse::Application.config.session\_store(
> :discourse\_cookie\_store, #it use to be **:cookie\_store**
> key: ‘\_forum\_session’,
> path: (Rails.application.config.relative\_url\_root.nil?) ? ‘/’ : Rails.application.config.relative\_url\_root
> )
even it raises `csrf_detected` failure at `callback_phase` method at oauth2 strategy file if `opts[:provider_ignores_state]` is set to true, cuz session[‘omniauth.state’] is nil
> elsif !options.provider\_ignores\_state && (request.params[“state”].to\_s.empty? || request.params[“state”] != session.delete(“omniauth.state”))
> fail!(:csrf\_detected, CallbackError.new(:csrf\_detected, “CSRF detected”))
Just to mention, everything works fine if I change it to `:cookie_store` rather than ':discourse\_cookie\_store`. is it a bug?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [27 maart 2017 om 23:08 UTC](https://meta.discourse.org/t/discourse-cookie-store-omniauth-callback-sessions-are-nil/58096/2 "2017-03-27T23:08:49Z")
Any ideas here @eviltrout?
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [28 maart 2017 om 14:44 UTC](https://meta.discourse.org/t/discourse-cookie-store-omniauth-callback-sessions-are-nil/58096/4 "2017-03-28T14:44:39Z")
Looking at git blame, the `:discourse_cookie_store` change was [5 months ago](https://github.com/discourse/discourse/commit/9848e26190436df1f834e274811ca462aa6164c8). Were you working with a branch that’s over 5 months old? If so I’m not surprised it broke!
---
### Author:  [@leo.proctor](https://meta.discourse.org/u/leo.proctor)
#### Post date: [29 maart 2017 om 09:09 UTC](https://meta.discourse.org/t/discourse-cookie-store-omniauth-callback-sessions-are-nil/58096/5 "2017-03-29T09:09:16Z")
It had to do with the recent addition of extra security for cookies [same site cookies](https://github.com/discourse/discourse/commit/ea1007e9541c089014626ca41522805e90821637) in discourse, which prevents sharing cookies with third party sites, which is kind of secure. I’m using a bit complex authentication system which involves SSO and OAuth2, where i had to share some cookies with our known authentication server. I added an exception in terms of sharing cookies with this server while perserving same site cookies feature and everything is working fine.
Thanks for response and such an awesome forum application. @codinghorror @eviltrout 😀
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [29 maart 2017 om 15:44 UTC](https://meta.discourse.org/t/discourse-cookie-store-omniauth-callback-sessions-are-nil/58096/6 "2017-03-29T15:44:30Z")