# Social Login only works on desktop, but not on mobile devices (CSRF detected)

**URL:** https://meta.discourse.org/t/social-login-funktioniert-nur-auf-desktop-aber-nicht-auf-mobilen-geraten-csrf-detected/389975
**Category:** SSO
**Tags:** mobile, oauth2, linkedin-oauth, google-login, login
**Created:** [30 november 2025 om 15:34 UTC](https://meta.discourse.org/t/social-login-funktioniert-nur-auf-desktop-aber-nicht-auf-mobilen-geraten-csrf-detected/389975 "2025-11-30T15:34:44Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![DW\_dev](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/dw_dev/32/490888_2.png) [@DW\_dev](https://meta.discourse.org/u/DW_dev)
#### Post date: [30 november 2025 om 19:13 UTC](https://meta.discourse.org/t/social-login-funktioniert-nur-auf-desktop-aber-nicht-auf-mobilen-geraten-csrf-detected/389975/4 "2025-11-30T19:13:29Z")

</div>

I found the solution to the issue where social logins (Google, Discord, etc.) fail with `csrf_detected` on mobile devices, even though they work on PC.

**The cause was in my theme:**

A **custom JavaScript script** in the `\u003chead\u003e` section of the theme was **constantly reloading** the page (`window.location.replace`) on mobile devices.

This forced redirect destroyed the **temporary CSRF token** necessary for session validation after the Google/Discord callback.

**Solution:**

I removed the entire script for **forcing the mobile view** from the theme.

If you have similar issues and are using a custom theme, check if there are any scripts running that trigger redirects. That was the culprit in my case!

---

_[View the full topic](https://meta.discourse.org/t/social-login-funktioniert-nur-auf-desktop-aber-nicht-auf-mobilen-geraten-csrf-detected/389975)._