# Invalid nonce error

**URL:** <https://meta.discourse.org/t/invalid-nonce-error/83264>\
**Category:** SSO\
**Created:** [March 19, 2018, 12:56am UTC](https://meta.discourse.org/t/invalid-nonce-error/83264 "2018-03-19T00:56:44Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![fefrei](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fefrei/32/119538_2.png) [@fefrei](https://meta.discourse.org/u/fefrei)\
**Post date:** [March 19, 2018, 9:12am UTC](https://meta.discourse.org/t/invalid-nonce-error/83264/2 "2018-03-19T09:12:15Z")

</div>

The nonce _has_ to be generated by Discourse. This is important for security.

Without the nonce, the SSO payload would in effect be a “golden ticket” 🎟 that could always be used to sign in that user, even if he changed his password, his account in the SSO source got disabled, …  
The nonce ensures that the SSO payload is a fresh response to the authentication request made by Discourse.

If you want the user to be signed into Discourse automatically, there are two easy ways:

1. Have Discourse be `login required`. Then, although the login will technically only happen once the user tries to access Discourse, the SSO process can be fully transparent to the user.
2. Embed an `iframe` that points to Discourse to start the SSO process (I think the right URL is `/session/sso`, but I’m not sure). Discourse will then generate the nonce and redirect to your app, which has to recognize the user by a cookie and redirect back with the corresponding SSO payload to close the deal.

---

_[View the full topic](https://meta.discourse.org/t/invalid-nonce-error/83264)._