<![CDATA[SAML CSRF token issue]]>Hi!

We have a setup in which FusionAuth is acting as SAML Idp, using hosted login pages.

Now if I try to login to the connected application through the /samlv2/login url in browser, it redirects to /oauth2/authorize. So far so good.

But, If I keep this browser tab open (tab A), then open a new tab (tab B) and also start the authorization process there, the saml.csrf cookie is now changed for tab A, which I think is the reason why if you try to finish the authorization process in tab A, you get a "OAuth return is missing a valid CSRF token." error.

Is there a way to avoid this? Or is it a consecuence of the CSRF system?

Additional information:

  • Tested on Chrome 137.0.7151.120
  • FusionAuth 1.57.0
]]>https://fusionauth.io/community/forum/topic/3009/saml-csrf-token-issueRSS for NodeSun, 19 Jul 2026 00:30:33 GMTMon, 30 Jun 2025 09:17:31 GMT60<![CDATA[Reply to SAML CSRF token issue on Fri, 11 Jul 2025 10:06:33 GMT]]>@mark-robustelli
Thanks I just did that.
https://github.com/FusionAuth/fusionauth-issues/issues/3113

]]>https://fusionauth.io/community/forum/post/8246https://fusionauth.io/community/forum/post/8246Fri, 11 Jul 2025 10:06:33 GMT<![CDATA[Reply to SAML CSRF token issue on Tue, 01 Jul 2025 14:08:05 GMT]]>@joseantonio Ah OK. That makes sense. I couldn't find much detail on how the saml.csrf cookie works. It does seem plausible that when a new window is open that a value could change that could be causing this problem. If it is causing you problems, it may be work opening a new issue.

]]>https://fusionauth.io/community/forum/post/8225https://fusionauth.io/community/forum/post/8225Tue, 01 Jul 2025 14:08:05 GMT<![CDATA[Reply to SAML CSRF token issue on Mon, 30 Jun 2025 16:16:40 GMT]]>@mark-robustelli

Thank you for the quick reply.

By "Also start the authorization process there?" I mean manually open a new tab for my application and clicking on "Login" which redirects to "/oauth2/authorize". So the same login process initiated twice in different tabs, then introducing login credentials on the first one.

The debug doesn't shed any light I'm afraid. The problem seems to be the "saml.csrf" cookie changing it's value across tabs.

]]>https://fusionauth.io/community/forum/post/8224https://fusionauth.io/community/forum/post/8224Mon, 30 Jun 2025 16:16:40 GMT<![CDATA[Reply to SAML CSRF token issue on Mon, 30 Jun 2025 15:12:37 GMT]]>@joseantonio said in SAML CSRF token issue:

also start the authorization process there

What do you mean by "Also start the authorization process there?" Manually open a new tab (tab B) and paste in the URL " /oauth2/authorize"?

If you enable debugging on the SAML tab for the Application in FusionAuth, do the logs indicate anything interesting?

]]>https://fusionauth.io/community/forum/post/8223https://fusionauth.io/community/forum/post/8223Mon, 30 Jun 2025 15:12:37 GMT