search

aspnet / AspNetKatana

Microsoft's OWIN implementation, the Katana project
Apache License 2.0
968 stars 334 forks source link

OpenIdConnectProtocolValidator cannot validate state #516

Open DevJasperNL opened 1 year ago

DevJasperNL commented 1 year ago

We are currently in the process of hardening our OIDC implementation. As part of this, we want state to be validated.

However, after enabling RequireState and RequireStateValidation, we get an exception: Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolInvalidStateException: 'IDX21329: RequireState is 'True' but the OpenIdConnectProtocolValidationContext.State is null. State cannot be validated.'

After further investiation, I see that inside the OpenIdConnectProtocolValidator, OpenIdConnectProtocolValidationContext.State remains null.

When looking into where this is created, it seems that State is never set on this context: https://github.com/aspnet/AspNetKatana/blob/ab378cfef173dd88c513fc037dec34c6e96b0178/src/Microsoft.Owin.Security.OpenIdConnect/OpenidConnectAuthenticationHandler.cs#L390

DevJasperNL commented 1 year ago

Related ASPNETCORE issue: https://github.com/dotnet/aspnetcore/issues/52400

Rora commented 11 months ago

I also need to know how to leverage the state, is there any update or expected timeline on this?

RickvF commented 10 months ago

I am facing the same issue. Can anyone please give an update on this?

Tratcher commented 10 months ago

This product is in maintenance mode, feature updates aren't expected. If someone would like to submit a PR then we can at least get this into the nightly builds.