# Issue: CSRF Detected Error with OAuth2 Login using oauth2-basic Plugin

**URL:** https://meta.discourse.org/t/issue-csrf-detected-error-with-oauth2-login-using-oauth2-basic-plugin/331505
**Category:** SSO
**Tags:** oauth2
**Created:** [October 18, 2024, 10:05am UTC](https://meta.discourse.org/t/issue-csrf-detected-error-with-oauth2-login-using-oauth2-basic-plugin/331505 "2024-10-18T10:05:40Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Ly\_Chen](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ly_chen/32/456921_2.png) [@Ly\_Chen](https://meta.discourse.org/u/Ly_Chen)
#### Post date: [October 18, 2024, 10:05am UTC](https://meta.discourse.org/t/issue-csrf-detected-error-with-oauth2-login-using-oauth2-basic-plugin/331505/1 "2024-10-18T10:05:40Z")

</div>

Hi,

I encountered a “csrf\_detected” error while using the `oauth2-basic` plugin to log in via OAuth2. Below is the detailed flow of the issue:

1. I click “Login,” which redirects me to:  
`https://myforum/auth/basic_oauth2`
2. It then performs a 302 redirect to:  
`https://myforum/auth/failure?message=csrf_detected`

### Reproduction Steps:

When I attempt to log in, the following `curl` command simulates the request:

```plaintext
curl -vvvv 'https://myforum/auth/oauth2_basic' \
  -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' \
  -H 'accept-language: zh-CN,zh;q=0.9' \
  -H 'cache-control: max-age=0' \
  -H 'content-type: application/x-www-form-urlencoded' \
  -H 'cookie: _forum_session=k9aHXc2cWsx%2FMBL26KTV33PSo8jC9Am47UBoT5Zq9qYAm2nKoU2BJkAR1bgc6U%2BYqsL3%2F3sjiYRmJoNr3JuvzkjdYl%2FjzT9djkq%2BYjSmN16EUEdZIdOl%2Fiv1MohQkthKSnOpUdXLTxHZBezxTg4O%2Bs6LUZ7HzCjpT3lxm24FS4xOPkU5QnSHBM%2F7GazZRhGywXsHKGdJ6fY0kVo%2BJHNNHBZu--qQKGn36Xh7jvKPEs--I1b3oz4nv2xe%2Fmi0bKPLog%3D%3D' \
  -H 'origin: https://myforum' \
  -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36' \
  --data-raw 'authenticity_token=doSNHEhj23HibAEZf0znqzevPNPq9Bub69Xnq18mKARw8GiGP-cokbg7k0qUvRgH3kayeJK7_-boeoOvX6GKqQ'

```

The result is a 302 redirect to the failure page with the message “csrf\_detected”:

```plaintext
< HTTP/2 302 
< location: /auth/failure?message=csrf_detected

```

### Findings:

- If I **omit** the `authenticity_token` parameter, the login flow works correctly, and it redirects me to the OAuth2 login page as expected:

### Question:

It seems that when the GET request to `/auth/oauth2_basic` includes an `authenticity_token`, the system checks it and throws the CSRF error if the token is invalid. But I’m confused—since I’m not logged in yet, how would I even have an `authenticity_token` at this stage?

Is this expected behavior, or is there an issue with how the CSRF token is being handled in the initial login process?

Any help or guidance would be appreciated!

Thank you!

---

<div class="post-metadata">

### Author: ![supermathie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/supermathie/32/507518_2.png) [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [October 18, 2024, 8:51pm UTC](https://meta.discourse.org/t/issue-csrf-detected-error-with-oauth2-login-using-oauth2-basic-plugin/331505/2 "2024-10-18T20:51:45Z")

</div>

We frequently [see this error](https://meta.discourse.org/t/troubleshooting-bad-csrf-error-on-initial-site-setup/97059) when there’s a mismatch between what the browser is using and what the backend is expecting.

Can you try turning on `force_https` and see if that fixes the problem?

If not, what’s your request path?