# Discourse redirects to the OAuth server after loading \`/?authComplete=true\`
**URL:** https://meta.discourse.org/t/discourse-redirects-to-the-oauth-server-after-loading-authcomplete-true/115973
**Category:** SSO
**Created:** [April 25, 2019, 3:51pm UTC](https://meta.discourse.org/t/discourse-redirects-to-the-oauth-server-after-loading-authcomplete-true/115973 "2019-04-25T15:51:00Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@ryancey](https://meta.discourse.org/u/ryancey)
#### Post date: [April 25, 2019, 3:51pm UTC](https://meta.discourse.org/t/discourse-redirects-to-the-oauth-server-after-loading-authcomplete-true/115973/1 "2019-04-25T15:51:00Z")
The flow is a bit complex. OAuth is the only allowed login on the Discourse instance. The whole idea is for the user to land back on the site they were before they were asked to create an account on the OAuth server.
It goes like this:
- User clicks `Login`
- Thanks to a [custom code snippet](https://meta.discourse.org/t/bypass-the-account-creation-modal-when-using-oauth2/110123/6), it goes directly to the (custom) OAuth server login page
- User clicks `Create an account` and creates an account on the OAuth server
- A confirmation e-mail is sent
Meanwhile, the OAuth server stores that when this particular e-mail is confirmed, and as soon as the user logs in again, it must redirect them to `https://[discourse-server]/auth/oauth2_basic` to automatically initiate a login process.
The issue is here.
- When the user clicks the OAuth server confirmation link **in the same browser session** (used from the first step)
- When the user clicks the OAuth server confirmation link **in a new browser session**
* * *
A screenshot to go with the text…
Text to go with the screenshot…
- #1 | The user has just confirmed its e-mail and successfully signs in, redirected to its profile page
- #2 | The profile page is where the custom redirection I was talking about is taking place, so the user is redirected to `https://[discourse-server]/auth/oauth2_basic`
- #3 | Discourse then redirects the user back to the OAuth server to initiate the login process
- #4 | OAuth authorization
- #5 | Discourse callback, redirecting the user to `/?authComplete=true`
- #6 | Bunch of assets loading (filtered in the devtools)
- **#7 | Boom** , out of nowhere, the user is redirected to the OAuth server root path
- #8 | … then redirected to its profile since they’re already logged in
* * *
So I’m guessing the extra redirect has something to do with a session-based storage.
Can someone point me to an area of the Discourse codebase where something like this would occur?
I’m [already digging](https://github.com/discourse/discourse/search?q=authComplete&unscoped_q=authComplete) but some help would be appreciated. Thanks a lot.
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [April 30, 2019, 6:08pm UTC](https://meta.discourse.org/t/discourse-redirects-to-the-oauth-server-after-loading-authcomplete-true/115973/2 "2019-04-30T18:08:57Z")
Do you have any ideas @david?
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [April 30, 2019, 6:53pm UTC](https://meta.discourse.org/t/discourse-redirects-to-the-oauth-server-after-loading-authcomplete-true/115973/3 "2019-04-30T18:53:35Z")
I’m not sure exactly what’s going on. @ryancey if you are able to share a link to the site I’d be happy to take a quick look.
Some of the logic around redirection is in
>
We use the omniauth origin system, which uses the referrer to determine the user’s starting location: [Saving User Location · omniauth/omniauth Wiki · GitHub](https://github.com/omniauth/omniauth/wiki/Saving-User-Location).
That can be overridden by the `destination_url` cookie, or the `origin=` URL parameter. You could try using `https://[discourse-server]/auth/oauth2_basic?origin=/`, to ensure that your users always end up on the forum homepage.
I know @LeoMcA recently made some improvements here, so make sure you’re running a recent version of Discourse.
---
### Author:  [@LeoMcA](https://meta.discourse.org/u/LeoMcA)
#### Post date: [April 30, 2019, 8:03pm UTC](https://meta.discourse.org/t/discourse-redirects-to-the-oauth-server-after-loading-authcomplete-true/115973/4 "2019-04-30T20:03:18Z")
> [@david](#):
>
> I know @LeoMcA recently made some improvements here, so make sure you’re running a recent version of Discourse.
I explain the problem I was seeing (and link to the changes I make) in this topic: [Redirect after logout with full screen login](https://meta.discourse.org/t/redirect-after-logout-with-full-screen-login/109755)
The difference here is that the issue I faced only happened after logout, not during the login process (but I imagine the problem lies in a similar section of code).
> [@ryancey](#):
>
> When the user clicks the OAuth server confirmation link **in the same browser session** (used from the first step)
> [@ryancey](#):
>
> When the user clicks the OAuth server confirmation link **in a new browser session**
This kind of change in behaviour across sessions strikes me as cookie oddness, so maybe have a look there.
I’ve sorta-kinda managed to decrypt session store cookies on live Discourse sites by copying [this function](https://gist.github.com/LeoMcA/a3e3f5d2c1448b763c587f1c53f06180) into the rails console before, but it’s messy. For proper debugging I’d suggest running [a dev image in docker](https://meta.discourse.org/t/beginners-guide-to-install-discourse-for-development-using-docker/102009) and adding this to `ApplicationController` to get it to print the current session cookie on every request.
```plaintext
before_action :print_session_cookie
def print_session_cookie
pp session
end
```
> [@ryancey](#):
>
> I’m [already digging](https://github.com/discourse/discourse/search?q=authComplete&unscoped_q=authComplete) but some help would be appreciated.
I imagine you’re already doing this, but just in case you’re not, I wouldn’t rely on github search to do digging like this. I find Atom’s search (other text editors are available) far more fast and reliable.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [May 15, 2019, 11:57am UTC](https://meta.discourse.org/t/discourse-redirects-to-the-oauth-server-after-loading-authcomplete-true/115973/7 "2019-05-15T11:57:11Z")
Hi @ryancey - thanks for the extra info via PM. I’ve now improved the behaviour so it should work better for this situation:
[https://github.com/discourse/discourse/commit/1299c94a5282693e57661f156b4072e3c890d7cc](https://github.com/discourse/discourse/commit/1299c94a5282693e57661f156b4072e3c890d7cc)
Please give it a try and let us know if it works.
---
### Author:  [@ryancey](https://meta.discourse.org/u/ryancey)
#### Post date: [May 17, 2019, 9:40am UTC](https://meta.discourse.org/t/discourse-redirects-to-the-oauth-server-after-loading-authcomplete-true/115973/9 "2019-05-17T09:40:38Z")
Just tested and it seems fixed 👍
Thanks a lot @david.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [May 20, 2019, 5:00pm UTC](https://meta.discourse.org/t/discourse-redirects-to-the-oauth-server-after-loading-authcomplete-true/115973/10 "2019-05-20T17:00:01Z")
This topic was automatically closed after 5 days. New replies are no longer allowed.