# OpenIdAuthenticator plugin fails **URL:** https://meta.discourse.org/t/openidauthenticator-plugin-fails/110186 **Category:** Development **Created:** [February 26, 2019, 11:19pm UTC](https://meta.discourse.org/t/openidauthenticator-plugin-fails/110186 "2019-02-26T23:19:46Z") **Posts on this page:** 1 **Showing post:** 2
### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david) #### Post date: [February 26, 2019, 11:41pm UTC](https://meta.discourse.org/t/openidauthenticator-plugin-fails/110186/2 "2019-02-26T23:41:47Z")
We have added CSRF protection to the OpenIDAuthenticator. That means that it sets the callback url to `https://your.forum/auth/openid/callback?state=xxxxxxxxx` (where xxxxx is randomly generated). The OpenID provider needs to redirect back to exactly that same URL. In theory this should work fine, and worked without changes on the one “official” openID integration (Yahoo). Note that “OpenID 2.0” has been declared obsolete, and it’s very likely we will remove it from Discourse soon. The best thing would be to move to a more modern specification like OpenID Connect. It looks like mojeID supports this new standard, so you could try the [Discourse OpenID Connect (OIDC)](https://meta.discourse.org/t/openid-connect-authentication-plugin/103632) --- _[View the full topic](https://meta.discourse.org/t/openidauthenticator-plugin-fails/110186)._