Custom state not set for OpenIdConnectProtocolValidator #52400
Description
Is there an existing issue for this?
- I have searched the existing issues
Describe the bug
We are currently in the process of hardening our OIDC implementation. As part of this, we want to add an antiforgery token to the state and validate it when getting the response from the IDP.
However, when using context.ProtocolMessage.State, enabling state validation on OpenIdConnectProtocolValidator causes an exception.
Expected Behavior
After enabling RequireState and RequireStateValidation, any state set in context.ProtocolMessage.State should be validated automatically.
Steps To Reproduce
When configuring OpenIdConnect, I am enabling both RequireState and RequireStateValidation:
options.ProtocolValidator.RequireState = true;
options.ProtocolValidator.RequireStateValidation = true;
Then in OnRedirectToIdentityProvider, I am configuring a custom state:
options.Events.OnRedirectToIdentityProvider = (RedirectContext context) =>
{
context.ProtocolMessage.State = "AntiForgery token will go here";
return Task.CompletedTask;
};
This will result in the following exception:
OpenIdConnectProtocolInvalidStateException: IDX21329: RequireState is 'System.Boolean' but the OpenIdConnectProtocolValidationContext.State is null. State cannot be validated.
After further investiation, I see that inside the OpenIdConnectProtocolValidator, OpenIdConnectProtocolValidationContext.State remains null.
When looking into where this is created, it seems that State is never set on this context:
Exceptions (if any)
OpenIdConnectProtocolInvalidStateException: IDX21329: RequireState is 'System.Boolean' but the OpenIdConnectProtocolValidationContext.State is null. State cannot be validated.
.NET Version
7.0.403
Anything else?
When looking into where this is created, it seems that State is never set on this context: