# Need help while Implementing SSO for dev environment

**URL:** https://meta.discourse.org/t/need-help-while-implementing-sso-for-dev-environment/302184
**Category:** SSO
**Tags:** dev-install
**Created:** [April 3, 2024, 5:35am UTC](https://meta.discourse.org/t/need-help-while-implementing-sso-for-dev-environment/302184 "2024-04-03T05:35:39Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![simon](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/simon/32/339122_2.png) [@simon](https://meta.discourse.org/u/simon)
#### Post date: [April 3, 2024, 3:47pm UTC](https://meta.discourse.org/t/need-help-while-implementing-sso-for-dev-environment/302184/2 "2024-04-03T15:47:48Z")

</div>

> [@Kamlesh\_Joshi](#):
>
> Nonce is incorrect, was generated in a different browser session, or has expired

This is the method that’s triggering the error:

```ruby
  def nonce_valid?
    if SiteSetting.discourse_connect_csrf_protection
      nonce && @secure_session[nonce_key].present?
    else
      nonce && Discourse.cache.read(nonce_key).present?
    end
  end

```

It’s checking that the nonce was generated by Discourse for the same session as as the one that redirects the user back to Discourse.

You could try setting the `discourse_connect_csrf_protection` site setting to `false`. Its default value is `true`. It’s a hidden site setting, so it can only be disabled from the Rails console.

When enabled, the `discourse_connect_csrf_protection` setting ensures that the entire SSO authentication process occurs through browser redirects. If you are starting the authentication process by making a background request to `session/sso`, you will need to disable it. More details here: [DiscourseConnect flow no longer functions - #5 by david](https://meta.discourse.org/t/discourseconnect-flow-no-longer-functions/182844/5).

---

_[View the full topic](https://meta.discourse.org/t/need-help-while-implementing-sso-for-dev-environment/302184)._