# Facebook Login Error: CSRF detected

**URL:** https://meta.discourse.org/t/facebook-login-error-csrf-detected/112599
**Category:** Support
**Created:** [March 26, 2019, 12:43pm UTC](https://meta.discourse.org/t/facebook-login-error-csrf-detected/112599 "2019-03-26T12:43:14Z")
**Posts on this page:** 1
**Showing post:** 3

<div class="post-metadata">

### Author: ![Ivan\_Rapekas](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ivan_rapekas/32/248924_2.png) [@Ivan\_Rapekas](https://meta.discourse.org/u/Ivan_Rapekas)
#### Post date: [January 13, 2022, 10:31am UTC](https://meta.discourse.org/t/facebook-login-error-csrf-detected/112599/3 "2022-01-13T10:31:46Z")

</div>

I have to improve my answer.

After playing with FB and Google auth, I stay on Office365 login because of company policy.

When I moved my discourse server behind a proxy (see the picture below), O365 auth became unavailable. It needs `force https` enabled and this option is broken behind the proxy. Solved thankfully by Daniel: [Moved site behind proxy, favicon and header not using https anymore - #11 by rossierd](https://meta.discourse.org/t/moved-site-behind-proxy-favicon-and-header-not-using-https-anymore/131486/11).

> The line in Internal Nginx config
> 
> ```plaintext
> proxy_set_header X-Forwarded-Proto $scheme;
> 
> ```
> 
> should be replaced with
> 
> ```plaintext
> proxy_set_header X-Forwarded-Proto "https";
> 
> ```

 ![020_discourse.drawio](https://global.discourse-cdn.com/meta/original/3X/8/f/8fd448ca4ab76d6490949fe585b95e4a33d58190.jpeg)

> External Nginx does not need such modification. It has:
> 
> ```plaintext
> proxy_set_header X-Forwarded-Proto $scheme;
> 
> ```

Probably the same is right for FB, Google and other types of auth.

P.S.

> [@Ivan\_Rapekas](#):
>
> Previously I wrote  
> `proxy_set_header X-Forwarded-Proto $https;`

Obviously that string contained a typo `$` and was useless.

---

_[View the full topic](https://meta.discourse.org/t/facebook-login-error-csrf-detected/112599)._