dotnet / dotnet/aspnetcore

Session timeout on external OAuth OIDC provider causes internal server error: message.State is null or empty

Open
#50,026 1 comment 0 reactions 0 assignees View on GitHub
area-auth investigate
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Describe the bug

We have two separate apps, a Blazor WASM app using .NET 7 and an ASP.NET Core Web App using .NET 6. Both are using an external OIDC provider that uses OAuth V2 and use the Microsoft.AspNetCore.Authentication.OpenIdConnect assembly to register the authenticator.

In these scenarios:
- If initiate a login, stay on the login page for more than 20 minutes to cause a session timeout within the OIDC provider, then continue to try to log in
- If I open two login windows for the same app and log in with two different users at the same time
- After I log in via this external OIDC provider and am redirected back to my app, if I click the back button on the browser

then the app is redirected to https://localhost:44338/authentication/callback?error=sessionexpired and it causes an internal server error: System.Exception: OpenIdConnectAuthenticationHandler: message.State is null or empty.

![image](https://github.com/dotnet/aspnetcore/assets/83760641/b43db7c6-eb32-4794-93a0-5c37f957923c)

We've tried using these existing events to handle the error, but none seem to fire
- OnTokenValidated
- OnRedirectToIdentityProvider
- OnAuthenticationFailed
- OnRemoteFailure

We also tried
- to use this property SkipUnrecognizedRequests but it didn't help with this issue. ([OpenIdConnectOptions.SkipUnrecognizedRequests Property (Microsoft.AspNetCore.Authentication.OpenIdConnect) | Microsoft Learn](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.openidconnect.openidconnectoptions.skipunrecognizedrequests?view=aspnetcore-7.0))
- to create an Authentication controller with a Callback action (because the callbackurl we have set is /authentication/callback) but it was not reaching the controller.
- to change the callback url to a location we already have but I couldn't get it to reach that controller either.

### Expected Behavior

Provide a way to handle the error scenario

### Steps To Reproduce

1. Create a Blazor WASM app with server side authentication using .NET 7 or an MVC ASP.NET Core Web App using .NET 6.
2. Implement OIDC with an 0Auth V2 provider using the Microsoft.AspNetCore.Authentication.OpenIdConnect assembly, e.g.
```
services.AddAuthentication(sharedOptions =>
{
sharedOptions.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
sharedOptions.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
sharedOptions.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
})
.AddOpenIdConnect(options =>
{
// Redacted
})
.AddCookie(options =>
{
// Redacted
});
```

### Exceptions (if any)

System.Exception: An error was encountered while handling the remote login.
---> System.Exception: OpenIdConnectAuthenticationHandler: message.State is null or empty.
--- End of inner exception stack trace ---
at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler`1.HandleRequestAsync()
at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)

### .NET Version

7.0.400

### Anything else?

dotnet --info
.NET SDK:
Version: 7.0.400
Commit: 73bf45718d

Runtime Environment:
OS Name: Windows
OS Version: 10.0.22000
OS Platform: Windows
RID: win10-x64
Base Path: C:\Program Files\dotnet\sdk\7.0.400\

Host:
Version: 7.0.10
Architecture: x64
Commit: a6dbb800a4

.NET SDKs installed:
2.2.207 [C:\Program Files\dotnet\sdk]
3.1.426 [C:\Program Files\dotnet\sdk]
5.0.406 [C:\Program Files\dotnet\sdk]
5.0.408 [C:\Program Files\dotnet\sdk]
7.0.105 [C:\Program Files\dotnet\sdk]
7.0.400 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
Microsoft.AspNetCore.All 2.2.8 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
Microsoft.AspNetCore.App 2.2.8 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 3.1.23 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 5.0.15 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 5.0.17 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 6.0.21 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 7.0.5 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 7.0.10 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App 2.2.8 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 3.1.23 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 5.0.15 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 5.0.17 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 6.0.16 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 6.0.21 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 7.0.5 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 7.0.10 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 3.1.23 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 5.0.15 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 5.0.17 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 6.0.16 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 6.0.21 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 7.0.5 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 7.0.10 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

Other architectures found:
x86 [C:\Program Files (x86)\dotnet]
registered at [HKLM\SOFTWARE\dotnet\Setup\InstalledVersions\x86\InstallLocation]

Environment variables:
Not set

global.json file:
Not found

Learn more:
https://aka.ms/dotnet/info

Download .NET:
https://aka.ms/dotnet/download

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.