OAuth account creation fails due to CSRF detection immediately after logging into Auth0 on same browser

The key is that Discourse needs to start the authentication flow at /auth/oauth2_basic, then redirect to Auth0, then come back to /auth/oauth2_basic/callback.

I was hoping we could get Auth0 to trigger login by starting with the first URL, but it sounds like it’s jumping Discourse straight to the callback URL.

Could you update the button to point to /auth/oauth2_basic on the forum? That will start the authentication flow and immediately redirect to Auth0, so the overall UX should be the same.

4 Likes