Invalid authentication configuration crashes ASP.NET core (stack overflow)
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 281
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Describe the bug
An invalid/incomplete ASPNET Core authentication configuration causes the framework to crash and generate a stack overflow.
### Expected Behavior
I would the application not to crash.
### Steps To Reproduce
If I:
1. Create a new empty ASP.NET Core application, .NET 8
2. Add OpenIdConnect NuGet package (Microsoft.AspNetCore.Authentication.OpenIdConnect 8.0.1)
3. add this code
```
builder.Services.AddAuthentication()
.AddOpenIdConnect("oidc", o =>
{
o.Authority = "https://example.com";
o.ClientId = "localhost-client";
o.ClientSecret = "mysecret";
o.ResponseType = "code";
o.Prompt = "consent";
});
```
4. I start the application
5. Then I get a stack overflow as shown below and the console output just outputs errors forever.
```
info: Microsoft.Hosting.Lifetime[14]
Now listening on: https://localhost:7106
info: Microsoft.Hosting.Lifetime[14]
Now listening on: http://localhost:5080
info: Microsoft.Hosting.Lifetime[0]
Application started. Press Ctrl+C to shut down.
info: Microsoft.Hosting.Lifetime[0]
Hosting environment: Development
info: Microsoft.Hosting.Lifetime[0]
Content root path: c:\code\WebApplication1\WebApplication1
Stack overflow.
at System.Threading.Tasks.Task.FromResult[[System.__Canon, System.Private.CoreLib, Version=8.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]](System.__Canon)
at System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1[[System.__Canon, System.Private.CoreLib, Version=8.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].SetResult(System.__Canon)
at Microsoft.AspNetCore.Authentication.AuthenticationHandlerProvider+d__5.MoveNext()
at System.Runtime.CompilerServices.AsyncMethodBuilderCore.Start[[Microsoft.AspNetCore.Authentication.AuthenticationHandlerProvider+d__5, Microsoft.AspNetCore.Authentication.Core, Version=8.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60]](d__5 ByRef)
...
```
Yes, the confiuration is not complete/valid.
### Exceptions (if any)
Stack Overflow
### .NET Version
dotnet --version 8.0.100
### Anything else?
_No response_
Contributor guide
Research direction
Reproduce the issue in a new .NET 8 application using Microsoft.AspNetCore.Authentication.OpenIdConnect 8.0.1 and the configuration shown. Start at AuthenticationHandlerProvider.GetHandlerAsync in the stack trace; done means the incomplete authentication configuration no longer causes a stack overflow or endless console errors.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- authentication, backend-api-design
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100