I’m seeing OIDC failures in Discourse logs: `CSRFTokenVerifier::InvalidCSRFToken` on `/auth/oidc` (POST)

SSO
1

Hi all,

I’m running Discourse 2026.2.0-latest (26f3e2aa87)
(Docker install, default nginx template, no Cloudflare). I have OpenID Connect enabled (Microsoft Entra / Azure AD).

When a user tries to sign up / log in via OIDC, Discourse records an error:

(oidc) Authentication failure! CSRFTokenVerifier::InvalidCSRFToken

In the log entry I can see the request is:

  • REQUEST_URI: /auth/oidc
  • REQUEST_METHOD: POST
  • Referrer: /signup

same_site_cookies is currently set to Lax.

My working theory is that the IdP is returning using response_mode=form_post (cross-site POST), so with SameSite=Lax the session cookie may not be included on the callback, causing Discourse’s CSRF verification to fail.

Questions:

  1. Is setting same_site_cookies = None the recommended / supported fix for OIDC providers that use form_post callbacks?
  2. If not, is there a recommended way to configure Discourse OIDC (or the IdP) so the callback is a GET (query) rather than form_post, to avoid needing SameSite=None?
  3. Are there any security/compatibility caveats with SameSite=None specifically for Discourse OIDC signups/logins?

Thanks!