# OIDC login via Discourse iOS app occasionally fails with csrf\_detected on callback

**URL:** https://meta.discourse.org/t/oidc-login-via-discourse-ios-app-occasionally-fails-with-csrf-detected-on-callback/394838
**Category:** SSO
**Tags:** openid-connect
**Created:** [31 בינואר,‏ 2026,‏ 11:51am UTC](https://meta.discourse.org/t/oidc-login-via-discourse-ios-app-occasionally-fails-with-csrf-detected-on-callback/394838 "2026-01-31T11:51:35Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Ethsim2](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ethsim2/32/522255_2.png) [@Ethsim2](https://meta.discourse.org/u/Ethsim2)
#### Post date: [1 בפברואר,‏ 2026,‏ 9:31am UTC](https://meta.discourse.org/t/oidc-login-via-discourse-ios-app-occasionally-fails-with-csrf-detected-on-callback/394838/2 "2026-02-01T09:31:32Z")

</div>

Extra data point from nginx access logs:

A representative failure (2026-01-25 11:44:10 UTC) shows the OIDC callback request is coming from an iOS _in-app browser_ UA (Snapchat), not the Discourse iOS app webview UA:

```plaintext
GET /auth/oidc/callback?...state=... 302
UA: Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) ... Snapchat/13.76.1.0 (like Safari/..., panda)
Referer: https://login.microsoftonline.com/

```

Immediately followed by:  
`GET /auth/failure?message=csrf_detected&strategy=oidc`

So it looks like the OAuth flow is sometimes initiated inside an iOS in-app browser (Snapchat/other),  
then the handoff occurs (I’ve also seen logs containing `auth_redirect=discourse://auth_redirect`),  
and the session cookie/state doesn’t survive consistently.

Current setting: `SiteSetting.same_site_cookies = "Lax"`.

Question: is Discourse’s mobile app auth flow expected to be reliable when the login is initiated from iOS in-app browsers that then deep-link into the Discourse app?  
Would switching `same_site_cookies` to “None” be the recommended mitigation here, or is there a better approach?

---

_[View the full topic](https://meta.discourse.org/t/oidc-login-via-discourse-ios-app-occasionally-fails-with-csrf-detected-on-callback/394838)._