dotnet / dotnet/AspNetCore.Docs
Using absolute URIs for the RedirectUri and LogoutUri causes an exception on production.
- Dominant language
- C#
- Stars
- 13.1k
- Forks
- 24.6k
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 97
Description
For the advise on setting the RedirectUri and LogoutUri, it should be a relative path, as absolute URIs are not guaranteed to work, such as in my own case: https://github.com/DuendeSoftware/Support/issues/750
https://learn.microsoft.com/en-us/aspnet/core/security/authentication/identity-api-authorization?view=aspnetcore-6.0#configuration-through-appsettings
The advise should be to set these URIs to relative paths: "/authentication/login-callback" and "/authentication/logout-callback" respectively
This is the error I was getting when using absolute URIs instead:
```
GET3021,000 B7 msChrome 114 https://og.deals/connect/authorize?client_id=ogdeals.Client&redirect_uri=https%3A%2F%2Fog.deals%2Fauthentication%2Flogin-callback&response_type=code&scope=ogdeals.ServerAPI%20openid%20profile&state=ecd2d2d41c304b5ba2e34f1fa6de5061&code_challenge=1C84ZiiXM4_P3nVXXiHtsOrfJjagBknWO0DIYkasL_4&code_challenge_method=S256&response_mode=query
info: Duende.IdentityServer.Hosting.IdentityServerMiddleware[0]
Invoking IdentityServer endpoint: Duende.IdentityServer.Endpoints.AuthorizeEndpoint for /connect/authorize
fail: Duende.IdentityServer.Validation.AuthorizeRequestValidator[0]
Invalid redirect_uri: https://og.deals/authentication/login-callback
{
"ClientId": "ogdeals.Client",
"ClientName": "ogdeals.Client",
"AllowedRedirectUris": [
"https://og.deals/authentication/login-callback"
],
"SubjectId": "anonymous",
"RequestedScopes": "",
"PromptMode": "",
"Raw": {
"client_id": "ogdeals.Client",
"redirect_uri": "https://og.deals/authentication/login-callback",
"response_type": "code",
"scope": "ogdeals.ServerAPI openid profile",
"state": "ecd2d2d41c304b5ba2e34f1fa6de5061",
"code_challenge": "1C84ZiiXM4_P3nVXXiHtsOrfJjagBknWO0DIYkasL_4",
"code_challenge_method": "S256",
"response_mode": "query"
}
}
fail: Duende.IdentityServer.Endpoints.AuthorizeEndpoint[0]
Request validation failed
info: Duende.IdentityServer.Endpoints.AuthorizeEndpoint[0]
{
"ClientId": "ogdeals.Client",
"ClientName": "ogdeals.Client",
"AllowedRedirectUris": [
"https://og.deals/authentication/login-callback"
],
"SubjectId": "anonymous",
"RequestedScopes": "",
"PromptMode": "",
"Raw": {
"client_id": "ogdeals.Client",
"redirect_uri": "https://og.deals/authentication/login-callback",
"response_type": "code",
"scope": "ogdeals.ServerAPI openid profile",
"state": "ecd2d2d41c304b5ba2e34f1fa6de5061",
"code_challenge": "1C84ZiiXM4_P3nVXXiHtsOrfJjagBknWO0DIYkasL_4",
"code_challenge_method": "S256",
"response_mode": "query"
}
}
```
---
#### Document Details
⚠ *Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.*
* ID: 21cb7455-3305-9316-5440-bdc22947a82d
* Version Independent ID: 137d4b94-7b26-3911-b22d-42c754a95fc1
* Content: [Introduction to authentication for Single Page Apps on ASP.NET Core](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/identity-api-authorization?view=aspnetcore-6.0)
* Content Source: [aspnetcore/security/authentication/identity-api-authorization.md](https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/security/authentication/identity-api-authorization.md)
* Product: **aspnet-core**
* Technology: **aspnetcore-security**
* GitHub Login: @javiercn
* Microsoft Alias: **riande**
Contributor guide
Assessment
This issue has not been assessed yet.