I am using in my instance’s and it provides me access to the api object. What I can’t figure out however, is how to generate a nonce with it. I’m detecting whether the visitor is logged into discourse or not, and whether they have a special cookie from the rest of my (non-discourse) site which indicates they’re logged in. If these 2 conditions are met, I do some magic to auto-log them into discourse. So far I’ve got it all working, except I have no nonce with which to create the signature that discourse needs when the user is redirected back. With no nonce I get the error: Verbose SSO log: Nonce has already expired How can I use the api object to ensure a nonce gets generated for my auto-logins?

Can’t you just redirect the user to the magic URL that triggers SSO? I’m not sure what the URL is and cannot check right now, it’s something like /session/sso.

In case anyone else finds this, I followed @fefrei’s advice Identify that the user has logged into your site Identify that the user is not currently logged into discourse Send the user to discourse’s /session/sso page which will trigger the sso with the nonce The SSO endpoint that gets the call from discourse recognizes it needs to do things automatically Log the user in and provide the necessary information back to discourse to complete the flow Its not pretty (causes the screen to flash) but it works. Thanks :+1:

How to generate nonce from client-side Javascript

Development

codinghorror (Jeff Atwood) September 11, 2017, 7:57am 3

I’d definitely follow our official SSO guide first Setup DiscourseConnect - Official Single-Sign-On for Discourse (sso)

Topic		Replies	Views
Invalid nonce error SSO	8	2717	March 19, 2018
DiscourseConnect without nonce SSO	0	700	August 15, 2021
I have a react app, and I want to implement the SSO feature. But I always get a nonce error Development sso	0	498	June 23, 2023
DiscourseConnect always returns "Nonce is incorrect, ..." SSO	0	142	March 13, 2025
Need help while Implementing SSO for dev environment SSO dev-install	1	467	April 3, 2024

How to generate nonce from client-side Javascript

Related topics