dotnet / dotnet/aspnetcore

Custom state not set for OpenIdConnectProtocolValidator

Open
#52,400 4 comments 0 reactions 0 assignees View on GitHub
area-auth investigate
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Describe the bug

We are currently in the process of hardening our OIDC implementation. As part of this, we want to add an antiforgery token to the state and validate it when getting the response from the IDP.

However, when using context.ProtocolMessage.State, enabling state validation on OpenIdConnectProtocolValidator causes an exception.

### Expected Behavior

After enabling RequireState and RequireStateValidation, any state set in context.ProtocolMessage.State should be validated automatically.

### Steps To Reproduce

When configuring OpenIdConnect, I am enabling both RequireState and RequireStateValidation:

```
options.ProtocolValidator.RequireState = true;
options.ProtocolValidator.RequireStateValidation = true;
```

Then in OnRedirectToIdentityProvider, I am configuring a custom state:

```
options.Events.OnRedirectToIdentityProvider = (RedirectContext context) =>
{
context.ProtocolMessage.State = "AntiForgery token will go here";
return Task.CompletedTask;
};
```

This will result in the following exception:
`OpenIdConnectProtocolInvalidStateException: IDX21329: RequireState is 'System.Boolean' but the OpenIdConnectProtocolValidationContext.State is null. State cannot be validated.`

After further investiation, I see that inside the OpenIdConnectProtocolValidator, OpenIdConnectProtocolValidationContext.State remains null.

When looking into where this is created, it seems that State is never set on this context:
https://github.com/dotnet/aspnetcore/blob/9efaf0e84dead340be574a27c6924efb5ffaa39b/src/Security/Authentication/OpenIdConnect/src/OpenIdConnectHandler.cs#L684

### Exceptions (if any)

OpenIdConnectProtocolInvalidStateException: IDX21329: RequireState is 'System.Boolean' but the OpenIdConnectProtocolValidationContext.State is null. State cannot be validated.

### .NET Version

7.0.403

### Anything else?

When looking into where this is created, it seems that State is never set on this context:
https://github.com/dotnet/aspnetcore/blob/9efaf0e84dead340be574a27c6924efb5ffaa39b/src/Security/Authentication/OpenIdConnect/src/OpenIdConnectHandler.cs#L684

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.