After signing in with sso, our client application redirect url is getting into loop

[harsha14581]

We are using authorization code flow. We have successfully signed in using sso url and after signed, redirect uri is continuously getting into loop.

In your we have https://domain.com/redirect_url?code=lsdjkflsdfjsldfjs (here code is changing but it is in continuous loop) In code local storage we cant see state storing or access token.

Could any one help us out. what could be issue. is it from client side or identity provider side.

[brockallen]

Not enough info. You will have to debug the protocol workflow.

[gary-archer]

The 2 most common redirect loop causes I've seen are around unreliable error handling.

• Authorization Server returns error details in error / error_description fields and the Web UI should present an error but instead ignores it and retriggers the OAuth flow
• API experiences a token validation problem and returns a 401 error when it should instead return a 500 error

In your case it looks like the Authorization Code Grant message is failing (perhaps due to a CORS configuration problem). If you can trace messages as in my write up you will quickly solve your own problem. Steps 8, 10 and 17 are most appropriate.

[waldenermonteiro]

I have the same loop redirection problem. However I noticed that at the edge it doesn't occur. It seems to be failing on the following line:

[waldenermonteiro]

I did a little investigation with @patrickmonteiro. And we identify an alert only when we are in a local development environment. Chrome warns you about cookies:

It appears to be a new implementation of Chrome for cookies with a default value for SameSite.

https://www.chromestatus.com/feature/5088147346030592

So we forced SameSite to be "None" and the redirection loop stopped.