Azure-activedirectory-identitymodel-extensions-for-dotnet: An unhandled exception occurred while processing the request.

[springe2004]

OpenIdConnectProtocolInvalidNonceException: IDX21323: RequireNonce is '[PII is hidden by default. Set the 'ShowPII' flag in IdentityModelEventSource.cs to true to reveal it.]'. OpenIdConnectProtocolValidationContext.Nonce was null, OpenIdConnectProtocol.ValidatedIdToken.Payload.Nonce was not null. The nonce cannot be validated. If you don't need to check the nonce, set OpenIdConnectProtocolValidator.RequireNonce to 'false'. Note if a 'nonce' is found it will be evaluated.

[springe2004]

some brower has this err

[Tratcher]

Something dropped your temp nonce cookie. Capture a Fiddler trace for more detail.

[springe2004]

Request URL:http://localhost:5000/consent
Request Method:POST
Status Code:302 Found
Remote Address:[::1]:5000
Response Headers
view source
Content-Length:0
Date:Wed, 11 Apr 2018 05:53:26 GMT
Location:/connect/authorize/callback?client_id=mvc&redirect_uri=http%3A%2F%2Flocalhost%3A5002%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20api1%20offline_access&response_mode=form_post&nonce=636590227888048501.MzRiZGFkNWItNzI3OC00N2NjLTg0YWItNDUzYWVlZjBhZmI1N2Q2Yjk4N2YtN2YwNS00MTBkLTgxOWItM2YxOGVmNzFjMTE3&state=CfDJ8BJ45KcoWI9ApSfI1yeeaugaEmME-8A3k_82-lSe4ZmIiOUejW4QLBdKIl_ZcVNqTlF0FPhmvN7hvW11mxoEOx1VljCxXYpI8cFiIcCinH5VSTuNU8akEZ4JJxTf0E8i5PXomyiNqtvUgfoBenSwTem2xXD7ERc2FMHJxfzSwCr_idgpdcsRYP3LGVLWrY_nbe98KHfplLDhCuW5rWZi_g-Z9CRZ3oqAfuXi_kf4ajHqhMKoffaaBAz2Hf6PD8-cXEwM-KAGnJLhNehAWBP70-W5TEgEKuepxSYd0JVwRAvGxHPQm7g-B7HgcFVrLJ93AMKUSkr_xOPXmqN6yCfILfk&x-client-SKU=ID_NETSTANDARD1_4&x-client-ver=5.2.1.0
Server:Kestrel
Set-Cookie:ConsentResponse.v-_MH3To51V42RNVEwhzaCvjd1yUnKgGgFcd9vQEQyY=CfDJ8NQO7oXxVzlMsGPTPBW6x-IcZa12BEMYmwqLfhhE5p2NFDa6vu8lqvE6s1u1H7q4T1RWYyXf_LQqIgAsq8pqcJ7ZgmNf4RVdVH81laquKbv3dRRGnBwTzA9x_oU9AXtzMx60aL1IZy7-i63LgZQ7RAqx2nh4rxLef7aunWbLnDXnrrqr2Z51WUrG2pGLODezbxXHdvXYACaQv4YKuzWDLlgD7DQ9SbTUWjDu6t4rezNUDkbqKCbFzuFGQolVA0dhgYsmi3_mhXX37Otj6hPuXikG62LgIZQB_dHYDSJ4eJlv; path=/; samesite=lax; httponly
X-Powered-By:ASP.NET
Request Headers
view source
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Encoding:gzip, deflate
Accept-Language:zh-CN,zh;q=0.8
Cache-Control:max-age=0
Connection:keep-alive
Content-Length:1176
Content-Type:application/x-www-form-urlencoded
Cookie:.AspNetCore.Antiforgery.wuhzzUagUO4=CfDJ8IVqIEg7Tp5Et0foUDrKWmmXvTbEcHn3dUbgt8MUF6y5E2DkPXdqPkM7l4SITT_F0WNwN_XiFh0kRR3Z0WQlTp4GHyDbAZoO3Q5OVSDDHZK6oUlMt5WsYZA-uqDSJ5CfhzyJlpaHs_x6bKkcTug-7Ps; .AspNetCore.Antiforgery.pKUIHQ3bYKs=CfDJ8NQO7oXxVzlMsGPTPBW6x-Ke-lJ6LFFvjEYHAZPWJhY-WEKkysPdxxdXT3BhvMtxn4woujG1smAj23eHxMxhs3q4XGFz-v92tebaxvgusiolQDg3hGh1SVNIwyOeTNnIf7wdf7595DTraDXgcWHsLD8; idsrv.session=52f66f9015bb1e06e01742746d04e87d; .AspNetCore.Cookies=CfDJ8NQO7oXxVzlMsGPTPBW6x-JJGOTvTqfBw8HpLtjgzCYDdeSfV_ZFd6JnIP4vo2hs7Ms50Rnlg7am1NpjTNwWPJRdtZ5NVt-aw4KdYoAXFL_0BPVjhPiEgpwNmnhyoO_HIg8rWGIndbVQOBz9PzYQghPoEGeYNeeAlXY1xiLWHXYp1RsQ10pmZ622M2iT8ezAhfeZCTBNNLBYLTUY1-BmIzSBhXfYJJYTShMftYGVu8-LB9zb7lFXetfQA4FnJwy_SmYkWN9kFORLySYLTlW7dW1mkU4ESVP0O5fj8vOv2Kmc0NPt2B2wAe6A4b9N-EGLVplL3ZT4dmOwoBozxr8PQf8jgZyFhZuV0qV6PPYoaxhYssgdtYM4fQ-eFgoELTkxxzW4TbTIyqc_9AOdCqLClpmTDyYQ1Y6Cw4PC8SKpMPWOXxP-a4vHoKBBTygMcpmYgYYZOGByxdXugdWPJTo2-0ZVuxmYvRip49GWyvxZII0JevOmg8vR7d5v5q4tbbKnY_KRxlvxgqn7kAWTtlOkeJ0
DNT:1
Host:localhost:5000
Origin:http://localhost:5000
Referer:http://localhost:5000/consent?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3Dmvc%26redirect_uri%3Dhttp%253A%252F%252Flocalhost%253A5002%252Fsignin-oidc%26response_type%3Dcode%2520id_token%26scope%3Dopenid%2520profile%2520api1%2520offline_access%26response_mode%3Dform_post%26nonce%3D636590227888048501.MzRiZGFkNWItNzI3OC00N2NjLTg0YWItNDUzYWVlZjBhZmI1N2Q2Yjk4N2YtN2YwNS00MTBkLTgxOWItM2YxOGVmNzFjMTE3%26state%3DCfDJ8BJ45KcoWI9ApSfI1yeeaugaEmME-8A3k_82-lSe4ZmIiOUejW4QLBdKIl_ZcVNqTlF0FPhmvN7hvW11mxoEOx1VljCxXYpI8cFiIcCinH5VSTuNU8akEZ4JJxTf0E8i5PXomyiNqtvUgfoBenSwTem2xXD7ERc2FMHJxfzSwCr_idgpdcsRYP3LGVLWrY_nbe98KHfplLDhCuW5rWZi_g-Z9CRZ3oqAfuXi_kf4ajHqhMKoffaaBAz2Hf6PD8-cXEwM-KAGnJLhNehAWBP70-W5TEgEKuepxSYd0JVwRAvGxHPQm7g-B7HgcFVrLJ93AMKUSkr_xOPXmqN6yCfILfk%26x-client-SKU%3DID_NETSTANDARD1_4%26x-client-ver%3D5.2.1.0
Upgrade-Insecure-Requests:1
User-Agent:Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 BIDUBrowser/8.7 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id:6DCD9CDF-6C35-4B04-8F51-886D59C62A6F
Form Data
view source
view URL encoded
ReturnUrl:/connect/authorize/callback?client_id=mvc&redirect_uri=http%3A%2F%2Flocalhost%3A5002%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20api1%20offline_access&response_mode=form_post&nonce=636590227888048501.MzRiZGFkNWItNzI3OC00N2NjLTg0YWItNDUzYWVlZjBhZmI1N2Q2Yjk4N2YtN2YwNS00MTBkLTgxOWItM2YxOGVmNzFjMTE3&state=CfDJ8BJ45KcoWI9ApSfI1yeeaugaEmME-8A3k_82-lSe4ZmIiOUejW4QLBdKIl_ZcVNqTlF0FPhmvN7hvW11mxoEOx1VljCxXYpI8cFiIcCinH5VSTuNU8akEZ4JJxTf0E8i5PXomyiNqtvUgfoBenSwTem2xXD7ERc2FMHJxfzSwCr_idgpdcsRYP3LGVLWrY_nbe98KHfplLDhCuW5rWZi_g-Z9CRZ3oqAfuXi_kf4ajHqhMKoffaaBAz2Hf6PD8-cXEwM-KAGnJLhNehAWBP70-W5TEgEKuepxSYd0JVwRAvGxHPQm7g-B7HgcFVrLJ93AMKUSkr_xOPXmqN6yCfILfk&x-client-SKU=ID_NETSTANDARD1_4&x-client-ver=5.2.1.0
ScopesConsented:openid
ScopesConsented:profile
ScopesConsented:api1
ScopesConsented:offline_access
RememberConsent:true
button:yes
__RequestVerificationToken:CfDJ8NQO7oXxVzlMsGPTPBW6x-Jc5LGjkIkG8CLOPdCu01b-iEIVxXBpMxkl8ItdL0RiNpzgHNsLBv-FvywXF_whm-zHsEwnBlcqCzIOC2Z0wTBMcBdYZh6GLVbo_HpVIN9tA8jceF_j4CjZ4utTxBphiU8rL0_NisjXF5wgY6Gh6cxXdpGNz8J5p9_ogWOCosBO-g
RememberConsent:false

[springe2004]

Request URL:http://localhost:5000/connect/authorize/callback?client_id=mvc&redirect_uri=http%3A%2F%2Flocalhost%3A5002%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20api1%20offline_access&response_mode=form_post&nonce=636590227888048501.MzRiZGFkNWItNzI3OC00N2NjLTg0YWItNDUzYWVlZjBhZmI1N2Q2Yjk4N2YtN2YwNS00MTBkLTgxOWItM2YxOGVmNzFjMTE3&state=CfDJ8BJ45KcoWI9ApSfI1yeeaugaEmME-8A3k_82-lSe4ZmIiOUejW4QLBdKIl_ZcVNqTlF0FPhmvN7hvW11mxoEOx1VljCxXYpI8cFiIcCinH5VSTuNU8akEZ4JJxTf0E8i5PXomyiNqtvUgfoBenSwTem2xXD7ERc2FMHJxfzSwCr_idgpdcsRYP3LGVLWrY_nbe98KHfplLDhCuW5rWZi_g-Z9CRZ3oqAfuXi_kf4ajHqhMKoffaaBAz2Hf6PD8-cXEwM-KAGnJLhNehAWBP70-W5TEgEKuepxSYd0JVwRAvGxHPQm7g-B7HgcFVrLJ93AMKUSkr_xOPXmqN6yCfILfk&x-client-SKU=ID_NETSTANDARD1_4&x-client-ver=5.2.1.0
Request Method:GET
Status Code:200 OK
Remote Address:[::1]:5000
Response Headers
view source
Cache-Control:no-store, no-cache, max-age=0
Content-Security-Policy:default-src 'none'; script-src 'sha256-VuNUSJ59bpCpw62HM2JG/hCyGiqoPN3NqGvNXQPU+rY=';
Content-Type:text/html; charset=UTF-8
Date:Wed, 11 Apr 2018 05:53:26 GMT
Pragma:no-cache
Referrer-Policy:no-referrer
Server:Kestrel
Set-Cookie:ConsentResponse.v-_MH3To51V42RNVEwhzaCvjd1yUnKgGgFcd9vQEQyY=.; expires=Fri, 31 Dec 1999 16:00:00 GMT; path=/; samesite=lax; httponly
Transfer-Encoding:chunked
X-Content-Security-Policy:default-src 'none'; script-src 'sha256-VuNUSJ59bpCpw62HM2JG/hCyGiqoPN3NqGvNXQPU+rY=';
X-Powered-By:ASP.NET
Request Headers
view source
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Encoding:gzip, deflate
Accept-Language:zh-CN,zh;q=0.8
Cache-Control:max-age=0
Connection:keep-alive
Cookie:.AspNetCore.Antiforgery.wuhzzUagUO4=CfDJ8IVqIEg7Tp5Et0foUDrKWmmXvTbEcHn3dUbgt8MUF6y5E2DkPXdqPkM7l4SITT_F0WNwN_XiFh0kRR3Z0WQlTp4GHyDbAZoO3Q5OVSDDHZK6oUlMt5WsYZA-uqDSJ5CfhzyJlpaHs_x6bKkcTug-7Ps; .AspNetCore.Antiforgery.pKUIHQ3bYKs=CfDJ8NQO7oXxVzlMsGPTPBW6x-Ke-lJ6LFFvjEYHAZPWJhY-WEKkysPdxxdXT3BhvMtxn4woujG1smAj23eHxMxhs3q4XGFz-v92tebaxvgusiolQDg3hGh1SVNIwyOeTNnIf7wdf7595DTraDXgcWHsLD8; idsrv.session=52f66f9015bb1e06e01742746d04e87d; .AspNetCore.Cookies=CfDJ8NQO7oXxVzlMsGPTPBW6x-JJGOTvTqfBw8HpLtjgzCYDdeSfV_ZFd6JnIP4vo2hs7Ms50Rnlg7am1NpjTNwWPJRdtZ5NVt-aw4KdYoAXFL_0BPVjhPiEgpwNmnhyoO_HIg8rWGIndbVQOBz9PzYQghPoEGeYNeeAlXY1xiLWHXYp1RsQ10pmZ622M2iT8ezAhfeZCTBNNLBYLTUY1-BmIzSBhXfYJJYTShMftYGVu8-LB9zb7lFXetfQA4FnJwy_SmYkWN9kFORLySYLTlW7dW1mkU4ESVP0O5fj8vOv2Kmc0NPt2B2wAe6A4b9N-EGLVplL3ZT4dmOwoBozxr8PQf8jgZyFhZuV0qV6PPYoaxhYssgdtYM4fQ-eFgoELTkxxzW4TbTIyqc_9AOdCqLClpmTDyYQ1Y6Cw4PC8SKpMPWOXxP-a4vHoKBBTygMcpmYgYYZOGByxdXugdWPJTo2-0ZVuxmYvRip49GWyvxZII0JevOmg8vR7d5v5q4tbbKnY_KRxlvxgqn7kAWTtlOkeJ0; ConsentResponse.v-_MH3To51V42RNVEwhzaCvjd1yUnKgGgFcd9vQEQyY=CfDJ8NQO7oXxVzlMsGPTPBW6x-IcZa12BEMYmwqLfhhE5p2NFDa6vu8lqvE6s1u1H7q4T1RWYyXf_LQqIgAsq8pqcJ7ZgmNf4RVdVH81laquKbv3dRRGnBwTzA9x_oU9AXtzMx60aL1IZy7-i63LgZQ7RAqx2nh4rxLef7aunWbLnDXnrrqr2Z51WUrG2pGLODezbxXHdvXYACaQv4YKuzWDLlgD7DQ9SbTUWjDu6t4rezNUDkbqKCbFzuFGQolVA0dhgYsmi3_mhXX37Otj6hPuXikG62LgIZQB_dHYDSJ4eJlv; samesite=lax
DNT:1
Host:localhost:5000
Referer:http://localhost:5000/consent?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3Dmvc%26redirect_uri%3Dhttp%253A%252F%252Flocalhost%253A5002%252Fsignin-oidc%26response_type%3Dcode%2520id_token%26scope%3Dopenid%2520profile%2520api1%2520offline_access%26response_mode%3Dform_post%26nonce%3D636590227888048501.MzRiZGFkNWItNzI3OC00N2NjLTg0YWItNDUzYWVlZjBhZmI1N2Q2Yjk4N2YtN2YwNS00MTBkLTgxOWItM2YxOGVmNzFjMTE3%26state%3DCfDJ8BJ45KcoWI9ApSfI1yeeaugaEmME-8A3k_82-lSe4ZmIiOUejW4QLBdKIl_ZcVNqTlF0FPhmvN7hvW11mxoEOx1VljCxXYpI8cFiIcCinH5VSTuNU8akEZ4JJxTf0E8i5PXomyiNqtvUgfoBenSwTem2xXD7ERc2FMHJxfzSwCr_idgpdcsRYP3LGVLWrY_nbe98KHfplLDhCuW5rWZi_g-Z9CRZ3oqAfuXi_kf4ajHqhMKoffaaBAz2Hf6PD8-cXEwM-KAGnJLhNehAWBP70-W5TEgEKuepxSYd0JVwRAvGxHPQm7g-B7HgcFVrLJ93AMKUSkr_xOPXmqN6yCfILfk%26x-client-SKU%3DID_NETSTANDARD1_4%26x-client-ver%3D5.2.1.0
Upgrade-Insecure-Requests:1
User-Agent:Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 BIDUBrowser/8.7 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id:6DCD9CDF-6C35-4B04-8F51-886D59C62A6F
Query String Parameters
view source
view URL encoded
client_id:mvc
redirect_uri:http://localhost:5002/signin-oidc
response_type:code id_token
scope:openid profile api1 offline_access
response_mode:form_post
nonce:636590227888048501.MzRiZGFkNWItNzI3OC00N2NjLTg0YWItNDUzYWVlZjBhZmI1N2Q2Yjk4N2YtN2YwNS00MTBkLTgxOWItM2YxOGVmNzFjMTE3
state:CfDJ8BJ45KcoWI9ApSfI1yeeaugaEmME-8A3k_82-lSe4ZmIiOUejW4QLBdKIl_ZcVNqTlF0FPhmvN7hvW11mxoEOx1VljCxXYpI8cFiIcCinH5VSTuNU8akEZ4JJxTf0E8i5PXomyiNqtvUgfoBenSwTem2xXD7ERc2FMHJxfzSwCr_idgpdcsRYP3LGVLWrY_nbe98KHfplLDhCuW5rWZi_g-Z9CRZ3oqAfuXi_kf4ajHqhMKoffaaBAz2Hf6PD8-cXEwM-KAGnJLhNehAWBP70-W5TEgEKuepxSYd0JVwRAvGxHPQm7g-B7HgcFVrLJ93AMKUSkr_xOPXmqN6yCfILfk
x-client-SKU:ID_NETSTANDARD1_4
x-client-ver:5.2.1.0

[springe2004]

Request URL:http://localhost:5002/signin-oidc
Request Method:POST
Status Code:500 Internal Server Error
Remote Address:[::1]:5002
Response Headers
view source
Content-Type:text/html; charset=utf-8
Date:Wed, 11 Apr 2018 05:53:27 GMT
Server:Kestrel
Transfer-Encoding:chunked
X-Powered-By:ASP.NET
Request Headers
view source
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Encoding:gzip, deflate
Accept-Language:zh-CN,zh;q=0.8
Cache-Control:max-age=0
Connection:keep-alive
Content-Length:1475
Content-Type:application/x-www-form-urlencoded
Cookie:.AspNetCore.Antiforgery.wuhzzUagUO4=CfDJ8IVqIEg7Tp5Et0foUDrKWmmXvTbEcHn3dUbgt8MUF6y5E2DkPXdqPkM7l4SITT_F0WNwN_XiFh0kRR3Z0WQlTp4GHyDbAZoO3Q5OVSDDHZK6oUlMt5WsYZA-uqDSJ5CfhzyJlpaHs_x6bKkcTug-7Ps; .AspNetCore.Correlation.oidc.3xbvqj1Z8zhxhb7p6GVDVE4M0jeWIKE5N5zEgcOTdBY=N; .AspNetCore.OpenIdConnect.Nonce.CfDJ8CdR04eKIZNMjXxC5kxhQm3_awlV1L2KvX65sCgfsw430C2ZUVNUhyyrWbfOIjZHuXIWK3aAvbLjlbCeXu90Hm0l92ir=N; .AspNetCore.Correlation.oidc.Snm22LHWD4rD9u7sUBKFlqu5r0WG5gzUf_6P9D1la5I=N; .AspNetCore.Antiforgery.pKUIHQ3bYKs=CfDJ8NQO7oXxVzlMsGPTPBW6x-Ke-lJ6LFFvjEYHAZPWJhY-WEKkysPdxxdXT3BhvMtxn4woujG1smAj23eHxMxhs3q4XGFz-v92tebaxvgusiolQDg3hGh1SVNIwyOeTNnIf7wdf7595DTraDXgcWHsLD8; idsrv.session=52f66f9015bb1e06e01742746d04e87d; .AspNetCore.Cookies=CfDJ8NQO7oXxVzlMsGPTPBW6x-JJGOTvTqfBw8HpLtjgzCYDdeSfV_ZFd6JnIP4vo2hs7Ms50Rnlg7am1NpjTNwWPJRdtZ5NVt-aw4KdYoAXFL_0BPVjhPiEgpwNmnhyoO_HIg8rWGIndbVQOBz9PzYQghPoEGeYNeeAlXY1xiLWHXYp1RsQ10pmZ622M2iT8ezAhfeZCTBNNLBYLTUY1-BmIzSBhXfYJJYTShMftYGVu8-LB9zb7lFXetfQA4FnJwy_SmYkWN9kFORLySYLTlW7dW1mkU4ESVP0O5fj8vOv2Kmc0NPt2B2wAe6A4b9N-EGLVplL3ZT4dmOwoBozxr8PQf8jgZyFhZuV0qV6PPYoaxhYssgdtYM4fQ-eFgoELTkxxzW4TbTIyqc_9AOdCqLClpmTDyYQ1Y6Cw4PC8SKpMPWOXxP-a4vHoKBBTygMcpmYgYYZOGByxdXugdWPJTo2-0ZVuxmYvRip49GWyvxZII0JevOmg8vR7d5v5q4tbbKnY_KRxlvxgqn7kAWTtlOkeJ0; .AspNetCore.OpenIdConnect.Nonce.CfDJ8ImaRhRDeUdDs0qXfHnInQEbn0zuhfFFkFAf9gcJLMPx9QMnlSuZ4WkJjzf9HQ8OEwbhVEtQ7OYLIODO-s78CL_7EN8D=N; .AspNetCore.Correlation.oidc.Tj70cuESB3diafBiezncz0WK4kYLtYLChrBrhyxT4XE=N; .AspNetCore.OpenIdConnect.Nonce.CfDJ8MePqHOln51JgeWA1bfokWxFVN6ONV1eAEhMGZZqLb0VWxbOrB1RacMHILGmIiW-wRnXv-SVOn73ILXyRDAuBt51Qtzd=N; .AspNetCore.Correlation.oidc.2to7CI4tqV6u06khjCvoh6_BnsIK4Ei96bHqMz3wWCU=N; .AspNetCore.OpenIdConnect.Nonce.CfDJ8BJ45KcoWI9ApSfI1yeeauhxN5lV5emTyzdoc-z3zewdHsnm_d01qdqSSn3q35cqQRaw2xWWnNXKE11CBB4gnFu6443_=N; .AspNetCore.Correlation.oidc.vT-_3RiLy-IrgOajZJSJWLTxao4BGqt_uROmTUHjB2M=N
DNT:1
Host:localhost:5002
Origin:http://localhost:5000
Referer:http://localhost:5000/connect/authorize/callback?client_id=mvc&redirect_uri=http%3A%2F%2Flocalhost%3A5002%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20api1%20offline_access&response_mode=form_post&nonce=636590227888048501.MzRiZGFkNWItNzI3OC00N2NjLTg0YWItNDUzYWVlZjBhZmI1N2Q2Yjk4N2YtN2YwNS00MTBkLTgxOWItM2YxOGVmNzFjMTE3&state=CfDJ8BJ45KcoWI9ApSfI1yeeaugaEmME-8A3k_82-lSe4ZmIiOUejW4QLBdKIl_ZcVNqTlF0FPhmvN7hvW11mxoEOx1VljCxXYpI8cFiIcCinH5VSTuNU8akEZ4JJxTf0E8i5PXomyiNqtvUgfoBenSwTem2xXD7ERc2FMHJxfzSwCr_idgpdcsRYP3LGVLWrY_nbe98KHfplLDhCuW5rWZi_g-Z9CRZ3oqAfuXi_kf4ajHqhMKoffaaBAz2Hf6PD8-cXEwM-KAGnJLhNehAWBP70-W5TEgEKuepxSYd0JVwRAvGxHPQm7g-B7HgcFVrLJ93AMKUSkr_xOPXmqN6yCfILfk&x-client-SKU=ID_NETSTANDARD1_4&x-client-ver=5.2.1.0
Upgrade-Insecure-Requests:1
User-Agent:Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 BIDUBrowser/8.7 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id:6DCD9CDF-6C35-4B04-8F51-886D59C62A6F
Form Data
view source
view URL encoded
code:ce52fd9b5b3d6dade0e8f7d5e53930489cf6777966261fbaf5d62cf0b8648e84
id_token:eyJhbGciOiJSUzI1NiIsImtpZCI6ImQ3NWU4M2E5ZTIwNWI3ZjA5MzlmZTk1ZWYxZmUxYzZmIiwidHlwIjoiSldUIn0.eyJuYmYiOjE1MjM0MjYwMDYsImV4cCI6MTUyMzQyNjMwNiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwIiwiYXVkIjoibXZjIiwibm9uY2UiOiI2MzY1OTAyMjc4ODgwNDg1MDEuTXpSaVpHRmtOV0l0TnpJM09DMDBOMk5qTFRnMFlXSXRORFV6WVdWbFpqQmhabUkxTjJRMllqazROMll0TjJZd05TMDBNVEJrTFRneE9XSXRNMll4T0dWbU56RmpNVEUzIiwiaWF0IjoxNTIzNDI2MDA2LCJjX2hhc2giOiJGVklLdWdKbjJqUXNPV1oxa3Y5NkJRIiwic2lkIjoiNTJmNjZmOTAxNWJiMWUwNmUwMTc0Mjc0NmQwNGU4N2QiLCJzdWIiOiIxIiwiYXV0aF90aW1lIjoxNTIzNDI1NjM5LCJpZHAiOiJsb2NhbCIsImFtciI6WyJwd2QiXX0.MODPmjTJXxaZmafCMNohhZOFI4xOtcxGpYgmFlo5bQnd922KchpnFfFHatAKcrjJaaHG8Oe9sXT32Fhp15X-5OBWpvR78qwGggc7qK9MMvvv2XiZfTo4vkYqwo-lLmuBawtdJX-_Y8WuTJvJKJZlq2OdXdC7GLub-TuyOXcH_bycvWW55UcV78qFxZZjAVT-vM2UmD2kMycjxZ1O_eLd5yo--q2iDBtBLUlQ5djij5uVFfWwNwpUFF9JqCU6oh3XhXVcOhGvB_gOMjLRW-xgRXSJdUWmdxpWESmin6uuXU2JRjLmOue8dSIJVYs6zNWmV4FMhZ4wWQu5S83jvBwx4w
scope:openid profile api1 offline_access
state:CfDJ8BJ45KcoWI9ApSfI1yeeaugaEmME-8A3k_82-lSe4ZmIiOUejW4QLBdKIl_ZcVNqTlF0FPhmvN7hvW11mxoEOx1VljCxXYpI8cFiIcCinH5VSTuNU8akEZ4JJxTf0E8i5PXomyiNqtvUgfoBenSwTem2xXD7ERc2FMHJxfzSwCr_idgpdcsRYP3LGVLWrY_nbe98KHfplLDhCuW5rWZi_g-Z9CRZ3oqAfuXi_kf4ajHqhMKoffaaBAz2Hf6PD8-cXEwM-KAGnJLhNehAWBP70-W5TEgEKuepxSYd0JVwRAvGxHPQm7g-B7HgcFVrLJ93AMKUSkr_xOPXmqN6yCfILfk
session_state:_S0CiXLywQbcfrFW01Hld-JKSlsbqcL1CnLMxbH74vs.218b11b546be2ac43b89e803ca1a8972

[Tratcher]

A single request is inadequate. You'd need to share the file with the whole login flow.

The above request has way more cookies than I'd expect on a clean login flow. Clear your cookies and start fresh.

[brentschmaltz]

@springe2004 we need additional information on this.
Moved issue to 5.2.3

[BKB503]

following error is producing on 1st login and when refresh(landing page) error is disappeared as it already having authenticated token. Is this something related to MVC session management? any ideas that would be helpful
Package Source : id="Microsoft.Owin.Security.OpenIdConnect" version="4.0.0"
DX21323: RequireNonce is '[PII is hidden by default. Set the 'ShowPII' flag in IdentityModelEventSource.cs to true to reveal it.]'. OpenIdConnectProtocolValidationContext.Nonce was null, OpenIdConnectProtocol.ValidatedIdToken.Payload.Nonce was not null. The nonce cannot be validated. If you don't need to check the nonce, set OpenIdConnectProtocolValidator.RequireNonce to 'false'. Note if a 'nonce' is found it will be evaluated.

[brentschmaltz]

@BKB503 can you set IdentityModelEventSource.ShowPII = true;
Then we can see the exact exception.

[BKB503]

@brentschmaltz Still same issue after adding ShowPII flag, Issue is with Session Cookie creation on start of the application when commented Session_Start and Session_End events in Global asax, it works great and able to create session cookie at later stage

[brentschmaltz]

@BKB503 I was out on vacation. Is this still an issue?

[BKB503]

@brentschmaltz Yes, Exact scenario is logging in first time and same time in Global.asax session cookie is initiating, as I said in previous comment commenting Session Start and End events it doesn't have this issue

[heyjackmototrek]

I have the same error when don't do anything on a page for a some time.
Is it requires some additional configuration in UseOpenIdConnectAuthentication middleware ?

Unfortunately disabling nonce validation just throws another exception
ProtocolValidator = new OpenIdConnectProtocolValidator
{
RequireNonce = false
}

Could this exception throw adal.js (Active Directory Authentication Library) library ?

IDX21323: RequireNonce is '[PII is hidden by default. Set the 'ShowPII' flag in IdentityModelEventSource.cs to true to reveal it.]'. OpenIdConnectProtocolValidationContext.Nonce was null, OpenIdConnectProtocol.ValidatedIdToken.Payload.Nonce was not null. The nonce cannot be validated. If you don't need to check the nonce, set OpenIdConnectProtocolValidator.RequireNonce to 'false'. Note if a 'nonce' is found it will be evaluated.

Does anyone know how to fix that issue ?

[brentschmaltz]

@heyjackmototrek because there is a nonce in the id_token, a nonce was sent as a parameter to the openidconnect request. The idp puts the nonce into the token.
What does the OIDC request look like.

[brentschmaltz]

@heyjackmototrek when you can get us the entire flow, we can investigate further.

[elgatorico]

Hey @brentschmaltz what exact information do you need? We experiencing this issue randomly, with no reliable way to reproduce it.

[hieuntp2]

I have same issue with current project. I have app using Ionic, Identity Server and backend. This issue sometime happen when user leave external login page for a while, maybe 15 mins.