# Social Login only works on desktop, but not on mobile devices (CSRF detected)

**URL:** <https://meta.discourse.org/t/social-login-funktioniert-nur-auf-desktop-aber-nicht-auf-mobilen-geraten-csrf-detected/389975>\
**Category:** SSO\
**Tags:** mobile, oauth2, linkedin-oauth, google-login, login\
**Created:** [November 30, 2025, 3:34pm UTC](https://meta.discourse.org/t/social-login-funktioniert-nur-auf-desktop-aber-nicht-auf-mobilen-geraten-csrf-detected/389975 "2025-11-30T15:34:44Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![DW\_dev](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/dw_dev/32/490888_2.png) [@DW\_dev](https://meta.discourse.org/u/DW_dev)\
**Post date:** [November 30, 2025, 3:34pm UTC](https://meta.discourse.org/t/social-login-funktioniert-nur-auf-desktop-aber-nicht-auf-mobilen-geraten-csrf-detected/389975/1 "2025-11-30T15:34:44Z")

</div>

Hello,  
my Discourse forum has a problem with social logins (Google, Discord, LinkedIn):

- **On desktop, all social logins work perfectly.**

- **On all mobile devices (iOS/Android, Safari/Chrome/Firefox), they fail.**

The mobile process:

1. Social login opens normally.

2. After the redirect back to my site, I only land **on the homepage** , but **I am not logged in**.

In the logs, every time it says:

```plaintext
(google_oauth2) Authentication failure! csrf_detected

```

or

```plaintext
(discord) Authentication failure! invalid_credentials: invalid_request

```

**What I have already checked:**

- OAuth setup correct (desktop works)

- Cookies/cache deleted on devices

- No in-app browsers, real browsers tested

- No matter which mobile browser → always CSRF detected

**Question:**  
What in Discourse can cause social logins to **only lose the session/cookies on mobile devices** and fail with `csrf_detected`?

Thanks for any help! 🙏

* * *

---

<div class="post-metadata">

**Author:** ![pfaffman](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pfaffman/32/120154_2.png) [@pfaffman](https://meta.discourse.org/u/pfaffman)\
**Post date:** [November 30, 2025, 3:48pm UTC](https://meta.discourse.org/t/social-login-funktioniert-nur-auf-desktop-aber-nicht-auf-mobilen-geraten-csrf-detected/389975/2 "2025-11-30T15:48:59Z")

</div>

Is this a [standard install](https://meta.discourse.org/t/142537?silent=true)? If not, do you have force\_https enabled?

---

<div class="post-metadata">

**Author:** ![DW\_dev](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/dw_dev/32/490888_2.png) [@DW\_dev](https://meta.discourse.org/u/DW_dev)\
**Post date:** [November 30, 2025, 4:07pm UTC](https://meta.discourse.org/t/social-login-funktioniert-nur-auf-desktop-aber-nicht-auf-mobilen-geraten-csrf-detected/389975/3 "2025-11-30T16:07:18Z")

</div>

Hello, yes it is a standard Discourse installation (installed on a Hetzner server).

---

<div class="post-metadata">

**Author:** ![DW\_dev](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/dw_dev/32/490888_2.png) [@DW\_dev](https://meta.discourse.org/u/DW_dev)\
**Post date:** [November 30, 2025, 7:13pm UTC](https://meta.discourse.org/t/social-login-funktioniert-nur-auf-desktop-aber-nicht-auf-mobilen-geraten-csrf-detected/389975/4 "2025-11-30T19:13:29Z")

</div>

I found the solution to the issue where social logins (Google, Discord, etc.) fail with `csrf_detected` on mobile devices, even though they work on PC.

**The cause was in my theme:**

A **custom JavaScript script** in the `\u003chead\u003e` section of the theme was **constantly reloading** the page (`window.location.replace`) on mobile devices.

This forced redirect destroyed the **temporary CSRF token** necessary for session validation after the Google/Discord callback.

**Solution:**

I removed the entire script for **forcing the mobile view** from the theme.

If you have similar issues and are using a custom theme, check if there are any scripts running that trigger redirects. That was the culprit in my case!

---

<div class="post-metadata">

**Author:** ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)\
**Post date:** [December 30, 2025, 7:14pm UTC](https://meta.discourse.org/t/social-login-funktioniert-nur-auf-desktop-aber-nicht-auf-mobilen-geraten-csrf-detected/389975/5 "2025-12-30T19:14:18Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.