Log decryption failures
Open
affected-medium
area-auth
enhancement
help wanted
severity-minor
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 281
Description
"Correlation failed" is one of the most common failures in OIDC or OAuth flows. Many of the things that can go wrong here happen on the client and can't be traced from the server. However there's one scenario where everything does flow back to the server and the server fails to decrypt the values. This can happen in a multi-node environment with misconfigured dataprotection (RE: https://github.com/aspnet/Security/issues/1755). We can highlight this by logging decryption failures in OAuth, OIDC, and CookieAuth.
Contributor guide
Assessment
This issue has not been assessed yet.