openid-provider returns mode='cancel' with POST method. This cause django's login CSRF error.
There are comment in the ticket that it should be GET method in standard, on http://jira.osqa.net/browse/OSQA-746?focusedCommentId=11489 OSQA, django application, openid consumer.

Django stop access on POST request without token and protect login hijack.

The response from Drupal is as follows:
OpenID redirect





document.getElementById("openid-redirect-form").submit();

Comments

anarcat’s picture

anarcat commented
Status: Active » Postponed (maintainer needs more info)

This was cleaned up a bit in beta6. Could you try again? Otherwise could you provide a test site where I could try to login to diagnose the issue?

Contrarily to what is mentionned in that issue, OpenID 2.0 authentication responses are done through POST, so the openid_provider actually behaves properly: https://openid.net/specs/openid-authentication-2_0.html#direct_comm

This wasn't always the case: we have recently fixed this to enable compatibility with janrain's OpenID libraries, see #831162: cannot login on stackoverflow or dotnetopenid sites. Oddly enough, the version you are reporting should *not* have been using post.

In any case, try again with beta6.

anarcat’s picture

anarcat commented
Status: Postponed (maintainer needs more info) » Closed (cannot reproduce)

in the absence of feedback, closing, please reopen if there are any other problems.