Session timeout on external OAuth OIDC provider causes internal server error: message.State is null or empty

[emmaSolirius]

Is there an existing issue for this?

• [X] I have searched the existing issues

Describe the bug

We have two separate apps, a Blazor WASM app using .NET 7 and an ASP.NET Core Web App using .NET 6. Both are using an external OIDC provider that uses OAuth V2 and use the Microsoft.AspNetCore.Authentication.OpenIdConnect assembly to register the authenticator.

In these scenarios:

• If initiate a login, stay on the login page for more than 20 minutes to cause a session timeout within the OIDC provider, then continue to try to log in
• If I open two login windows for the same app and log in with two different users at the same time
• After I log in via this external OIDC provider and am redirected back to my app, if I click the back button on the browser

then the app is redirected to https://localhost:44338/authentication/callback?error=sessionexpired and it causes an internal server error: System.Exception: OpenIdConnectAuthenticationHandler: message.State is null or empty.

We've tried using these existing events to handle the error, but none seem to fire

• OnTokenValidated
• OnRedirectToIdentityProvider
• OnAuthenticationFailed
• OnRemoteFailure

We also tried

• to use this property SkipUnrecognizedRequests but it didn't help with this issue. (OpenIdConnectOptions.SkipUnrecognizedRequests Property (Microsoft.AspNetCore.Authentication.OpenIdConnect) | Microsoft Learn)
• to create an Authentication controller with a Callback action (because the callbackurl we have set is /authentication/callback) but it was not reaching the controller.
• to change the callback url to a location we already have but I couldn't get it to reach that controller either.

Expected Behavior

Provide a way to handle the error scenario

Steps To Reproduce

1. Create a Blazor WASM app with server side authentication using .NET 7 or an MVC ASP.NET Core Web App using .NET 6.
2. Implement OIDC with an 0Auth V2 provider using the Microsoft.AspNetCore.Authentication.OpenIdConnect assembly, e.g.

   services.AddAuthentication(sharedOptions =>
   {
   sharedOptions.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
   sharedOptions.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
   sharedOptions.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
   })
   .AddOpenIdConnect(options =>
   {
   // Redacted
   })
   .AddCookie(options =>
   {
   // Redacted
   });

Exceptions (if any)

System.Exception: An error was encountered while handling the remote login. ---> System.Exception: OpenIdConnectAuthenticationHandler: message.State is null or empty. --- End of inner exception stack trace --- at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler`1.HandleRequestAsync() at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context) at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)

.NET Version

7.0.400

Anything else?

dotnet --info .NET SDK: Version: 7.0.400 Commit: 73bf45718d

Runtime Environment: OS Name: Windows OS Version: 10.0.22000 OS Platform: Windows RID: win10-x64 Base Path: C:\Program Files\dotnet\sdk\7.0.400\

Host: Version: 7.0.10 Architecture: x64 Commit: a6dbb800a4

.NET SDKs installed: 2.2.207 [C:\Program Files\dotnet\sdk] 3.1.426 [C:\Program Files\dotnet\sdk] 5.0.406 [C:\Program Files\dotnet\sdk] 5.0.408 [C:\Program Files\dotnet\sdk] 7.0.105 [C:\Program Files\dotnet\sdk] 7.0.400 [C:\Program Files\dotnet\sdk]

.NET runtimes installed: Microsoft.AspNetCore.All 2.2.8 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All] Microsoft.AspNetCore.App 2.2.8 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App] Microsoft.AspNetCore.App 3.1.23 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App] Microsoft.AspNetCore.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App] Microsoft.AspNetCore.App 5.0.15 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App] Microsoft.AspNetCore.App 5.0.17 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App] Microsoft.AspNetCore.App 6.0.21 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App] Microsoft.AspNetCore.App 7.0.5 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App] Microsoft.AspNetCore.App 7.0.10 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App] Microsoft.NETCore.App 2.2.8 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.NETCore.App 3.1.23 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.NETCore.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.NETCore.App 5.0.15 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.NETCore.App 5.0.17 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.NETCore.App 6.0.16 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.NETCore.App 6.0.21 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.NETCore.App 7.0.5 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.NETCore.App 7.0.10 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.WindowsDesktop.App 3.1.23 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App] Microsoft.WindowsDesktop.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App] Microsoft.WindowsDesktop.App 5.0.15 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App] Microsoft.WindowsDesktop.App 5.0.17 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App] Microsoft.WindowsDesktop.App 6.0.16 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App] Microsoft.WindowsDesktop.App 6.0.21 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App] Microsoft.WindowsDesktop.App 7.0.5 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App] Microsoft.WindowsDesktop.App 7.0.10 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

Other architectures found: x86 [C:\Program Files (x86)\dotnet] registered at [HKLM\SOFTWARE\dotnet\Setup\InstalledVersions\x86\InstallLocation]

Environment variables: Not set

global.json file: Not found

Learn more: https://aka.ms/dotnet/info

Download .NET: https://aka.ms/dotnet/download

[ghost]

We've moved this issue to the Backlog milestone. This means that it is not going to be worked on for the coming release. We will reassess the backlog following the current release and consider this item at that time. To learn more about our issue management process and to have better expectation regarding different types of issues you can read our Triage Process.