dotnet / dotnet/aspnetcore

Invalid authentication configuration crashes ASP.NET core (stack overflow)

Open
#53,267 5 comments 3 reactions 0 assignees View on GitHub
area-auth enhancement Pillar: Dev Experience
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Describe the bug

An invalid/incomplete ASPNET Core authentication configuration causes the framework to crash and generate a stack overflow.

### Expected Behavior

I would the application not to crash.

### Steps To Reproduce

If I:

1. Create a new empty ASP.NET Core application, .NET 8
2. Add OpenIdConnect NuGet package (Microsoft.AspNetCore.Authentication.OpenIdConnect 8.0.1)
3. add this code
```
builder.Services.AddAuthentication()
.AddOpenIdConnect("oidc", o =>
{
o.Authority = "https://example.com";

o.ClientId = "localhost-client";
o.ClientSecret = "mysecret";

o.ResponseType = "code";
o.Prompt = "consent";

});

```

4. I start the application
5. Then I get a stack overflow as shown below and the console output just outputs errors forever.

```
info: Microsoft.Hosting.Lifetime[14]
Now listening on: https://localhost:7106
info: Microsoft.Hosting.Lifetime[14]
Now listening on: http://localhost:5080
info: Microsoft.Hosting.Lifetime[0]
Application started. Press Ctrl+C to shut down.
info: Microsoft.Hosting.Lifetime[0]
Hosting environment: Development
info: Microsoft.Hosting.Lifetime[0]
Content root path: c:\code\WebApplication1\WebApplication1
Stack overflow.
at System.Threading.Tasks.Task.FromResult[[System.__Canon, System.Private.CoreLib, Version=8.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]](System.__Canon)
at System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1[[System.__Canon, System.Private.CoreLib, Version=8.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].SetResult(System.__Canon)
at Microsoft.AspNetCore.Authentication.AuthenticationHandlerProvider+d__5.MoveNext()
at System.Runtime.CompilerServices.AsyncMethodBuilderCore.Start[[Microsoft.AspNetCore.Authentication.AuthenticationHandlerProvider+d__5, Microsoft.AspNetCore.Authentication.Core, Version=8.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60]](d__5 ByRef)
...
```

Yes, the confiuration is not complete/valid.

### Exceptions (if any)

Stack Overflow

### .NET Version

dotnet --version 8.0.100

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue in a new .NET 8 application using Microsoft.AspNetCore.Authentication.OpenIdConnect 8.0.1 and the configuration shown. Start at AuthenticationHandlerProvider.GetHandlerAsync in the stack trace; done means the incomplete authentication configuration no longer causes a stack overflow or endless console errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
authentication, backend-api-design
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.