What do I do if I get a "you may be a victim of cross-site request forgery" message?

During Facebook login, you may encounter the following message:

The state doesn't match. You may be a victim of cross-site request forgery or you may have decided to cancel the login process. Please close this window.

Or this message:

You may have not allowed the email address to be used or the token is not valid. You may be a victim of cross-site request forgery or the method of connecting to the Facebook URL with HTTPS is not allowed. Please contact the merchant to warn him.

These messages do not identify a single cause. The first means that the callback state does not match the session state, or that the expected code is missing. An interrupted attempt or a lost session can lead to this check.

Checks

1. Close the login window and start one new attempt from the shop, without reusing an old callback URL.
2. Compare the redirect URL displayed by the module for the relevant shop with the authorized OAuth URI in your Facebook app. Use the complete, exact URL.
3. Check HTTPS and the hostname used throughout the attempt: a redirect between www and non-www, or between shops, can change the session context.
4. If the error persists, ask your integrator or support to check session persistence, redirects and logs stripped of confidential data.

Privacy policy URLs must meet the app’s requirements; they do not all mechanically have to share the callback’s prefix.

Do not disable the state check to bypass the error. For general app configuration, see the Facebook procedure. For a session that does not stay logged in, see this FAQ.