search

aspnet-contrib / AspNet.Security.OpenId.Providers

OpenID 2.0 authentication middleware for ASP.NET Core
Apache License 2.0
225 stars 40 forks source link

Antiforgery issue when hosted in AWS ECS #168

Open drond opened 9 months ago

drond commented 9 months ago

Hello!

I'm using steam auth in my app (.NET 8 Blazor ssr app) and came across the issue - when running localy (pure dotnet or doker) everything goes well Auth working as expected, but once I've published my App into AWS ECS cluster it stopped working.

Looks like there is some issue with Antiforgery cookies:

Maybe you could help with solving that as I'm totally exhausted with googling anything related to that issue :(

PS Meanwhile deployed my app (kinda just an pure API with steam auth) into DigitalOcean and it works... but not in AWS

martincostello commented 9 months ago
AndreiShirmanov commented 9 months ago
  • Where are you storing your data protection keys? It could be that they're not being stored in a shared location that all the ECS pods can access so don't agree on all the settings. Documentation
  • Have you configured HTTP forwarded headers to be trusted appropriately so that things like whether the request is over HTTPS are honoured? It could be that things aren't being trusted correctly, so the app things requests are over HTTP instead of HTTPS, so cookies get "lost". Documentation.

Thank you for rapid reaction

1) there is a single pod within single service in ECS, and i even tried AWS solution that stores protection keys in shared systems manager.

2) looks like this one i have to investigate a bit deeper, will take a look and get back to you

drond commented 9 months ago
  • Where are you storing your data protection keys? It could be that they're not being stored in a shared location that all the ECS pods can access so don't agree on all the settings. Documentation
  • Have you configured HTTP forwarded headers to be trusted appropriately so that things like whether the request is over HTTPS are honoured? It could be that things aren't being trusted correctly, so the app things requests are over HTTP instead of HTTPS, so cookies get "lost". Documentation.

Soooo, after futher investigation I've noticed a warning in Chrome about attempt to set SECURE cookie over HTTP request (I didn't set up https yet). And in my cookie policy it was set to AlwaysSecure/SameSite.None. So i've changed config to SameAsRequest/SameSite.Lax and boom, done. Anyway thank you for your help )

PS I understand that using non-secure cookies is not a good idea, but so far so good, I don't have experience in setting up certificates etc :)