0

Recently I'm learning idenetty server 4, I organized a test project in github

env: windows 10, edge edge: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.96 Safari/537.36 Edg/88.0.705.56

   services.AddAuthentication(options =>
        {
            options.DefaultScheme = "Cookies";
            options.DefaultChallengeScheme = "oidc";
        })
        // 添加可以处理cookie的处理程序
        .AddCookie("Cookies")
        // 用于配置执行OpenID Connect协议的处理程序
        .AddOpenIdConnect("oidc", options =>
        {
            options.Authority = "https://demo.identityserver.io/";    // 受信任令牌服务地址
            options.RequireHttpsMetadata = true;
            options.ClientId = "interactive.confidential";
            options.ClientSecret = "secret";
            options.ResponseType = "code";
            options.SaveTokens = true;  // 用于将来自IdentityServer的令牌保留在cookie中

            // 1、添加授权访问api的支持
            //options.Scope.Add("scope1");
            options.Scope.Add("email");
            //options.Scope.Add("profile");
            options.GetClaimsFromUserInfoEndpoint = true;
            //options.Scope.Add("offline_access");
            options.TokenValidationParameters = new TokenValidationParameters
            {
                NameClaimType = "name",
                RoleClaimType = "role"
            };
        });

The problem is that I have logged in and authorized successfully, but when I jump back, the following error will appear

Exception: Correlation failed.
Unknown location

Exception: An error was encountered while handling the remote login.
Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler<TOptions>.HandleRequestAsync()

After that, I saw some questions about cookies. I added a ConfigureNonBreakingSameSiteCookies, but it still didn't work

when I disabled edge config Cookies without SameSite must be secure, it success.

the question is Is there any other way?

If anyone can provide me some insight on this, I would greatly appreciate it.

2
  • You should not need to deal with SameSite in .NET 5, also you should try to use HTTPS instead of HTTP. Feb 3, 2021 at 10:46
  • yes, i got it.Thank you. I have been using HTTP and forgot to use HTTPS
    – sdwdjzhy
    Feb 4, 2021 at 0:18

3 Answers 3

1

As per the above comment, this is likely due to you not using HTTPS. That correlation cookie will be set to SameSite=None or SameSite=Lax since it needs to be accessible during a request initiated by another host and Chrome and Edge will block it by default if not issued by an HTTPS origin.

0
0

I got this error when adding two different federated clients and didn't customize the callback url. So when the federated client is returning the user to /signin-oidc (default return url path) it doesn't know which one to sign you in with. The fix is to set these OpenIdConnectOptions for each federated client configured:

options.CallbackPath = "/signin-custom2";
options.SignedOutCallbackPath = "/signout-callback-custom2";
options.RemoteSignOutPath = "/signout-custom2";
0

Needs to both Client and server HTTPS

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.