FoF OAuth (Google) - Infinite OAuth redirect loop on Flarum 2.0.0-rc.5
Hi everyone,
I'm experiencing an issue with Google OAuth using FoF OAuth on a fresh Flarum installation.
Environment
- Flarum: v2.0.0-rc.5
- FoF OAuth: 2.0.0-beta.3
- PHP: 8.3
- HTTPS enabled
- Cloudflare proxy enabled
- Google OAuth application configured correctly
Google OAuth configuration
Authorized JavaScript Origin:
https://forum.example.com
Authorized Redirect URI:
https://forum.example.com/auth/google
The application is in Testing mode and the Google account used is added as a Test User.
Problem
Clicking "Log in with Google" redirects correctly to Google.
The user:
- Selects a Google account.
- Accepts the permissions.
- Google redirects back to Flarum.
However, instead of completing the login or registration, Flarum immediately starts a new OAuth flow, sending the user back to Google again.
This results in an infinite loop:
Flarum
↓
Google Account Chooser
↓
Consent Screen
↓
https://forum.example.com/auth/google?code=...
↓
HTTP 302
↓
accounts.google.com/oauth2/v2/auth
↓
Google Account Chooser again
The user is never logged in or registered.
Browser Network
The callback does reach Flarum.
Example:
GET /auth/google?state=...&code=...
HTTP 302
Immediately afterwards Flarum redirects to:
https://accounts.google.com/o/oauth2/v2/auth...
with a brand new OAuth state.
So the callback is received, but FoF OAuth appears to restart the authentication process instead of completing the authentication.
Additional information
The issue occurs with both:
- Default Flarum theme
- Avocado theme
Browser cookies look correct:
Secure = true
HttpOnly = true
SameSite = Lax
The Flarum base URL is configured correctly.
Recreating the Google OAuth Client ID and Client Secret did not change the behavior.
The Redirect URI matches exactly.
What has already been ruled out
- Wrong Client ID
- Wrong Client Secret
- Wrong Redirect URI
- Google Test Users
- HTTPS configuration
- Theme-specific issue
At this point it looks like FoF OAuth receives the callback successfully but immediately starts a new authorization request instead of finalizing the authentication.
Has anyone experienced this with Flarum 2.0.0-rc.5 and FoF OAuth 2.0.0-beta.3?
Any ideas on what else could be causing this behavior?
Installed versions
Flarum: v2.0.0-rc.5
FoF OAuth: 2.0.0-beta.3
PHP: 8.3
