search

aspnet / AspNetKatana

Microsoft's OWIN implementation, the Katana project
Apache License 2.0
959 stars 331 forks source link

OpenIdConnectProtocolValidator cannot validate state #516

Open DevJasperNL opened 7 months ago

DevJasperNL commented 7 months ago

We are currently in the process of hardening our OIDC implementation. As part of this, we want state to be validated.

However, after enabling RequireState and RequireStateValidation, we get an exception: Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolInvalidStateException: 'IDX21329: RequireState is 'True' but the OpenIdConnectProtocolValidationContext.State is null. State cannot be validated.'

After further investiation, I see that inside the OpenIdConnectProtocolValidator, OpenIdConnectProtocolValidationContext.State remains null.

When looking into where this is created, it seems that State is never set on this context: https://github.com/aspnet/AspNetKatana/blob/ab378cfef173dd88c513fc037dec34c6e96b0178/src/Microsoft.Owin.Security.OpenIdConnect/OpenidConnectAuthenticationHandler.cs#L390

DevJasperNL commented 7 months ago

Related ASPNETCORE issue: https://github.com/dotnet/aspnetcore/issues/52400

Rora commented 7 months ago

I also need to know how to leverage the state, is there any update or expected timeline on this?

RickvF commented 5 months ago

I am facing the same issue. Can anyone please give an update on this?

Tratcher commented 5 months ago

This product is in maintenance mode, feature updates aren't expected. If someone would like to submit a PR then we can at least get this into the nightly builds.