dotnet / dotnet/aspnetcore

OIDC - Validation failure during PAR does not trigger OnAuthenticationFailed() event

Open
#59,462 9 comments 1 reaction 0 assignees View on GitHub
api-proposal api-ready-for-review area-auth feature-oidc
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

`OpenIdConnectHandler.cs`

When a validation failure occurs during a PAR request (ex. the request includes an invalid client_id), an `OpenIdConnectProtocolException` is thrown. This exception bubbles up as an unhandled middleware exception.

This happens during `HandleChallengeAsync()`, but that method does not catch this (or any other) exception and call the `OnAuthenticationFailed()` event.

### Expected Behavior

I would expect this type of error to trigger the `OnAuthenticationFailed()` event so that it can be specifically handled.

Before PAR, the user is redirected to the IDP for login. That redirect request carried with it the client app's configuration (client_id, redirect_uri, etc). If that information was not valid, the IDP itself would handle presentation of the error to the end user.

With PAR, we are moving the validation response handling to the client application.

### Steps To Reproduce

_No response_

### Exceptions (if any)

_No response_

### .NET Version

9.0.101

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.