# OAuth2 csrf\_detected with Discord 'Connect' functionality
**URL:** https://meta.discourse.org/t/oauth2-csrf-detected-with-discord-connect-functionality/226991
**Category:** SSO
**Created:** [May 14, 2022, 12:25am UTC](https://meta.discourse.org/t/oauth2-csrf-detected-with-discord-connect-functionality/226991 "2022-05-14T00:25:44Z")
**Posts on this page:** 16
**Page:** 1
### Author:  [@FerrariFlunker](https://meta.discourse.org/u/FerrariFlunker)
#### Post date: [May 14, 2022, 12:25am UTC](https://meta.discourse.org/t/oauth2-csrf-detected-with-discord-connect-functionality/226991/1 "2022-05-14T00:25:44Z")
Hello! I’m in desperate need of some help with figuring out this error:
* * *
**Steps to reproduce:**
When a user clicks on their Discord “Connect” button in Preferences,
it correctly redirects the user to Discord’s authorization page.
However after clicking the Authorize button, the user is redirected and met with this message on our forum:
and the error at the top of this topic shows up in the admin logs.
* * *
I feel like I’ve read and tried everything to fix this, but it continues to happen. I’ve made sure the Discord Client ID and Secret site settings are correct.
I also made sure the URI was the correct syntax (based on a few related topics I’ve seen):
Any suggestions? I’m willing to try anything, even if you’re unsure it will work 😆
---
### Author:  [@FerrariFlunker](https://meta.discourse.org/u/FerrariFlunker)
#### Post date: [May 16, 2022, 8:33pm UTC](https://meta.discourse.org/t/oauth2-csrf-detected-with-discord-connect-functionality/226991/2 "2022-05-16T20:33:25Z")
Any ideas? Still struggling with this 😕
---
### Author:  [@FerrariFlunker](https://meta.discourse.org/u/FerrariFlunker)
#### Post date: [May 17, 2022, 10:04pm UTC](https://meta.discourse.org/t/oauth2-csrf-detected-with-discord-connect-functionality/226991/3 "2022-05-17T22:04:34Z")
I _think_(?) I’ve narrowed it down to an nginx and/or caching issue? Is there supposed to be auth-specific or CSRF-specific stuff defined in discourse.conf that we could be missing?
---
### Author:  [@FerrariFlunker](https://meta.discourse.org/u/FerrariFlunker)
#### Post date: [May 19, 2022, 1:19am UTC](https://meta.discourse.org/t/oauth2-csrf-detected-with-discord-connect-functionality/226991/4 "2022-05-19T01:19:32Z")
@merefield, @david, @sam - sorry for the pings but I see your names in a lot of the older csrf related discussions in the past. Do you have any recommendations for this? With Discord auth being an integrated part of discourse, I’m stumped what could be causing this.
I appreciate any and all help in advance, thanks ☺
---
### Author:  [@FerrariFlunker](https://meta.discourse.org/u/FerrariFlunker)
#### Post date: [May 23, 2022, 3:57am UTC](https://meta.discourse.org/t/oauth2-csrf-detected-with-discord-connect-functionality/226991/5 "2022-05-23T03:57:12Z")
We must be breaking [one of these](https://api.rubyonrails.org/v5.2.4.4/classes/ActionController/RequestForgeryProtection.html#method-i-verified_request-3F)?
>
I’m still unable to find a pattern. Sometimes it works and connects me correctly, but other times I’m met with the csrf page.
At the moment, I’m most suspect of the last condition check in `verified_request?`.
Are there any ways to easily check if `(valid_request_origin? && any_authenticity_token_valid?)` is returning true?
---
### Author:  [@FerrariFlunker](https://meta.discourse.org/u/FerrariFlunker)
#### Post date: [May 25, 2022, 3:57am UTC](https://meta.discourse.org/t/oauth2-csrf-detected-with-discord-connect-functionality/226991/6 "2022-05-25T03:57:15Z")
I apologize for the lack of any debug-able information, but I think I was (painfully) able to find (at least what I think) is the issue. I’m still not sure what the fix is, so please read on 😘
* * *
The pictures below show a back-to-back instance where I was able to successfully link my account, refreshed/tried it again, and unsuccessfully hit the csrf detected page. I was in an incognito window and did/changed literally nothing between the successful connect and csrf failure. Here’s what I found:
So this first pic shows the \_forum\_session cookie matching in both 1 and 2 request headers, which resulted in a successful connect.
However after I reloaded the page and tried again (and failed to connect), you can see my search on the left side only shows 1 occurrence of the \_forum\_session cookie in a request header when it resulted in a failure.
tl;dr: I’m pretty sure the issue stems from the forum\_session cookie in the discord?reconnect request header and then the following callback? request header not matching. What would cause them to be different?
---
### Author:  [@FerrariFlunker](https://meta.discourse.org/u/FerrariFlunker)
#### Post date: [May 26, 2022, 12:01am UTC](https://meta.discourse.org/t/oauth2-csrf-detected-with-discord-connect-functionality/226991/7 "2022-05-26T00:01:57Z")
Ok, I think we’re getting closer.
So in this pic below, you can see an update POST request happening directly **after** the discord?reconnect POST request.
* * *
And sure enough, it’s setting the \_forum\_session cookie which is causing it to mismatch like I described above.
If I check a successful connection instance (below), you can see the update only occurs **before** the discord?reconnect POST request.
This causes the \_forum\_session cookie to match and for it to successfully connect the account without the csrf issue.
**How do I prevent that update from occurring after the user has begun the connection process?**
---
### Author:  [@merefield](https://meta.discourse.org/u/merefield)
#### Post date: [May 26, 2022, 10:14am UTC](https://meta.discourse.org/t/oauth2-csrf-detected-with-discord-connect-functionality/226991/8 "2022-05-26T10:14:57Z")
@FerrariFlunker sorry for slow response, but haven’t had chance to look at this, it would be great if the core team could.
if its any consolation, I can repro, I believe, I’m getting the same error:
`(discord) Authentication failure! csrf_detected: OmniAuth::Strategies::OAuth2::CallbackError, csrf_detected | CSRF detected`
---
### Author:  [@FerrariFlunker](https://meta.discourse.org/u/FerrariFlunker)
#### Post date: [May 30, 2022, 1:20am UTC](https://meta.discourse.org/t/oauth2-csrf-detected-with-discord-connect-functionality/226991/11 "2022-05-30T01:20:58Z")
No worries @merefield, I appreciate the response!
Are you getting that error in your own environment? I think either way, this error needs to be looked at by the core team. I’m 2+ weeks into debugging this and still haven’t found an answer 😕
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [May 30, 2022, 8:21am UTC](https://meta.discourse.org/t/oauth2-csrf-detected-with-discord-connect-functionality/226991/12 "2022-05-30T08:21:46Z")
> [@FerrariFlunker](#):
>
> So in this pic below, you can see an update POST request happening directly **after** the discord?reconnect POST request.
>
> 
>
> And sure enough, it’s setting the \_forum\_session cookie which is causing it to mismatch like I described above.
Nice digging! This kind of race condition could certainly cause the issues you’re seeing.
That said, we haven’t had any other reports of this problem, so it sounds like it must be something specific to your site/configuration. What plugins do you have installed on the site? Can you open up the “update” call and see what payload is being sent?
---
### Author:  [@FerrariFlunker](https://meta.discourse.org/u/FerrariFlunker)
#### Post date: [May 30, 2022, 9:37pm UTC](https://meta.discourse.org/t/oauth2-csrf-detected-with-discord-connect-functionality/226991/13 "2022-05-30T21:37:18Z")
> [@david](#):
>
> Can you open up the “update” call and see what payload is being sent?
> [@david](#):
>
> so it sounds like it must be something specific to your site/configuration.
After taking a look at the update calls, I’m thinking you’re right. Here are some screenshots of confirmed ‘update’ requests that caused csrf failures.
I’m seeing a pattern involving cdn 🧐 What would be misconfigured with that? Let me know if you still need a list of our plugins, I just figured I’d save this reply from +1 picture 😄
---
### Author:  [@FerrariFlunker](https://meta.discourse.org/u/FerrariFlunker)
#### Post date: [June 7, 2022, 12:25am UTC](https://meta.discourse.org/t/oauth2-csrf-detected-with-discord-connect-functionality/226991/14 "2022-06-07T00:25:01Z")
I have an exciting update! A few days ago, I took a closer look at the ‘update’ payload and happened to successfully associate this:
with one of our plugins! 🥳 😑 😄
After disabling the plugin, further testing, and a successful launch of the related feature to the community… I think I can confidently say we found the culprit.
So this plugin turned out to be the trouble-maker: [GitHub - discourse/discourse-chat: Chat inside Discourse · GitHub](https://github.com/discourse/discourse-chat)
In hindsight it makes sense why this would be the culprit- the plugin is still marked as experimental and isn’t intended for production sites. 😓
Since I’m 3+ weeks into diagnosing this issue and need to get back on track with our community’s other projects 😵💫, unfortunately I won’t be able to help find the fix for the discourse-chat plugin.
If someone ends up pushing a fix to the plugin, we’d (most likely 😄) look into re-enabling the plugin on our site, but for now we need stable associated account Connect functionality
Thanks again to everyone who helped diagnose! 👍
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [June 16, 2022, 12:01pm UTC](https://meta.discourse.org/t/oauth2-csrf-detected-with-discord-connect-functionality/226991/17 "2022-06-16T12:01:41Z")
Thanks for the super detailed investigation @FerrariFlunker!
I’ve just made a PR for a fix in Discourse core:
[https://github.com/discourse/discourse/pull/17108](https://github.com/discourse/discourse/pull/17108)
The reason it was fixed after removing the chat plugin is that Chat makes heavy use of this ‘PresenceChannel’ API, and so the issue is far more likely to happen. I don’t think any changes will be required in chat.
---
### Author:  [@ClawdiaWolf](https://meta.discourse.org/u/ClawdiaWolf)
#### Post date: [June 16, 2022, 12:16pm UTC](https://meta.discourse.org/t/oauth2-csrf-detected-with-discord-connect-functionality/226991/18 "2022-06-16T12:16:14Z")
Should this fix the same issue with Google Logins? My users on one of my instances where we were testing the chat plugin _loved_ it, but it broke Google logins with the same error as the Discord logins.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [June 16, 2022, 12:38pm UTC](https://meta.discourse.org/t/oauth2-csrf-detected-with-discord-connect-functionality/226991/19 "2022-06-16T12:38:36Z")
Yep, this fix will apply to all different login types 👍
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [July 6, 2022, 11:28am UTC](https://meta.discourse.org/t/oauth2-csrf-detected-with-discord-connect-functionality/226991/20 "2022-07-06T11:28:43Z")