OIDC - Validation failure during PAR does not trigger OnAuthenticationFailed() event
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 290
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Describe the bug
`OpenIdConnectHandler.cs`
When a validation failure occurs during a PAR request (ex. the request includes an invalid client_id), an `OpenIdConnectProtocolException` is thrown. This exception bubbles up as an unhandled middleware exception.
This happens during `HandleChallengeAsync()`, but that method does not catch this (or any other) exception and call the `OnAuthenticationFailed()` event.
### Expected Behavior
I would expect this type of error to trigger the `OnAuthenticationFailed()` event so that it can be specifically handled.
Before PAR, the user is redirected to the IDP for login. That redirect request carried with it the client app's configuration (client_id, redirect_uri, etc). If that information was not valid, the IDP itself would handle presentation of the error to the end user.
With PAR, we are moving the validation response handling to the client application.
### Steps To Reproduce
_No response_
### Exceptions (if any)
_No response_
### .NET Version
9.0.101
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.