# I’m seeing OIDC failures in Discourse logs: \`CSRFTokenVerifier::InvalidCSRFToken\` on \`/auth/oidc\` (POST)

**URL:** https://meta.discourse.org/t/i-m-seeing-oidc-failures-in-discourse-logs-csrftokenverifier-invalidcsrftoken-on-auth-oidc-post/395752
**Category:** SSO
**Tags:** openid-connect
**Created:** [February 11, 2026, 7:26am UTC](https://meta.discourse.org/t/i-m-seeing-oidc-failures-in-discourse-logs-csrftokenverifier-invalidcsrftoken-on-auth-oidc-post/395752 "2026-02-11T07:26:07Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![Ethsim2](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ethsim2/32/522255_2.png) [@Ethsim2](https://meta.discourse.org/u/Ethsim2)
#### Post date: [February 11, 2026, 7:26am UTC](https://meta.discourse.org/t/i-m-seeing-oidc-failures-in-discourse-logs-csrftokenverifier-invalidcsrftoken-on-auth-oidc-post/395752/1 "2026-02-11T07:26:07Z")

</div>

Hi all,

I’m running Discourse 2026.2.0-latest ([26f3e2aa87](https://github.com/discourse/discourse/commits/26f3e2aa87a3abb35849183e0740fe7ab84cec67))  
(Docker install, default nginx template, no Cloudflare). I have OpenID Connect enabled (Microsoft Entra / Azure AD).

When a user tries to sign up / log in via OIDC, Discourse records an error:

`(oidc) Authentication failure! CSRFTokenVerifier::InvalidCSRFToken`

In the log entry I can see the request is:

- `REQUEST_URI: /auth/oidc`
- `REQUEST_METHOD: POST`
- Referrer: `/signup`

`same_site_cookies` is currently set to `Lax`.

My working theory is that the IdP is returning using `response_mode=form_post` (cross-site POST), so with `SameSite=Lax` the session cookie may not be included on the callback, causing Discourse’s CSRF verification to fail.

Questions:

1. Is setting `same_site_cookies = None` the recommended / supported fix for OIDC providers that use `form_post` callbacks?
2. If not, is there a recommended way to configure Discourse OIDC (or the IdP) so the callback is a GET (query) rather than `form_post`, to avoid needing `SameSite=None`?
3. Are there any security/compatibility caveats with `SameSite=None` specifically for Discourse OIDC signups/logins?

Thanks!