Saml2: Errror: "Server cannot append header after HTTP headers have been sent."

[JustinPealing]

We are seeing the following exception when using Kentor AuthServices (v0.17.2) against a SAML2 provider (Ping Federate) using HTTP-POST binding - this issue goes away if we use another binding (e.g. redirect).

2016-04-19 15:05:58,194 [5] ERROR Web.Global - Unhandled error
System.Web.HttpException (0x80004005): Server cannot append header after HTTP headers have been sent.
   at System.Web.HttpHeaderCollection.SetHeader(String name, String value, Boolean replace)
   at Microsoft.Owin.Host.SystemWeb.CallHeaders.AspNetResponseHeaders.Set(String key, String[] values)
   at Microsoft.Owin.ResponseCookieCollection.Append(String key, String value, CookieOptions options)
   at Kentor.AuthServices.Owin.CommandResultExtensions.ApplyCookies(CommandResult commandResult, IOwinContext context, IDataProtector dataProtector)
   at Kentor.AuthServices.Owin.CommandResultExtensions.Apply(CommandResult commandResult, IOwinContext context, IDataProtector dataProtector)
   at Kentor.AuthServices.Owin.KentorAuthServicesAuthenticationHandler.<ApplyResponseChallengeAsync>d__1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Owin.Security.Infrastructure.AuthenticationHandler.<ApplyResponseCoreAsync>d__b.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Owin.Security.Infrastructure.AuthenticationHandler.<ApplyResponseAsync>d__8.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Owin.Security.Infrastructure.AuthenticationHandler.<TeardownAsync>d__5.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Owin.Security.Infrastructure.AuthenticationMiddleware`1.<Invoke>d__0.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Owin.SignOutMessageCookieExtension.<<ConfigureSignOutMessageCookie>b__0>d__5.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Owin.UseCookieAuthenticationExtension.<>c__DisplayClass9.<<ConfigureCookieAuthentication>b__6>d__10.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Owin.Security.Infrastructure.AuthenticationMiddleware`1.<Invoke>d__0.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Owin.Security.Infrastructure.AuthenticationMiddleware`1.<Invoke>d__0.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Owin.Security.Infrastructure.AuthenticationMiddleware`1.<Invoke>d__0.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Owin.Cors.CorsMiddleware.<Invoke>d__0.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Owin.OwinExtensions.<>c__DisplayClass2.<<UseAutofacMiddleware>b__0>d__7.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Owin.ConfigureRenderLoggedOutPageExtension.<<ConfigureRenderLoggedOutPage>b__0>d__2.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Owin.ConfigureIdentityServerIssuerExtension.<>c__DisplayClass5.<<ConfigureIdentityServerIssuer>b__1>d__7.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Owin.ConfigureIdentityServerBaseUrlExtension.<>c__DisplayClass1.<<ConfigureIdentityServerBaseUrl>b__0>d__3.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Owin.ConfigureRequestIdExtension.<<ConfigureRequestId>b__0>d__2.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Owin.Mapping.MapMiddleware.<Invoke>d__0.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.IntegratedPipelineContextStage.<RunApp>d__5.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.IntegratedPipelineContext.<DoFinalWork>d__2.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.StageAsyncResult.End(IAsyncResult ar)
   at System.Web.HttpApplication.AsyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

[AndersAbel]

Thanks for reporting this. I think the error is caused by the order of actions in Kentor.AuthServices.Owin.CommandResultExtensions.Apply. It will probably go away if the cookies are set before the body is written. The only cases where we're both setting cookies and writing a body is on AuthnRequests/LogoutRequests with a POST binding. For outbound AuthnRequests the cookie was introduced in version 0.17.1 so unless you need features/bug fixes in this version a workaround may be to use 0.17.0 until this is fixed.

[JustinPealing]

Thanks for the quick reply - rolling back to 0.17.0 is working for us.

[dmeierotto]

Hi @AndersAbel , I am on v19 and still see this issue. Just came back to this project and switched on SLO(e.g. I had DisableOutboundLogoutRequests = true from a few months ago) and started getting this error.

Update- looks like stack trace is different, coming from IDServer. Maybe a different issue.

OK, I think this is other sequencing issue with the removal of the IDSrv Signin cookie for whatever reason. Stack trace is below, I will keep looking but this only happens when I have the SLO enabled. Maybe you have an idea. thanks!

System.InvalidOperationException ---> System.Web.HttpException: Server cannot append header after HTTP headers have been sent.
   at System.Web.HttpHeaderCollection.SetHeader(String name, String value, Boolean replace)
   at Microsoft.Owin.Host.SystemWeb.CallHeaders.AspNetResponseHeaders.Set(String key, String[] values)
   at Microsoft.Owin.ResponseCookieCollection.Append(String key, String value, CookieOptions options) in c:\local\identity\server3\IdentityServer3\source\Core\Validation\ScopeValidator.cs:line 0
   at IdentityServer3.Core.Configuration.Hosting.MessageCookie`1.ClearByCookieName(String name) in c:\local\identity\server3\IdentityServer3\source\Core\Configuration\Hosting\MessageCookie.cs:line 196
   at IdentityServer3.Core.Extensions.InternalOwinExtensions.ProcessRemovalOfSignOutMessageCookie(IOwinContext context, MessageCookie`1 signOutMessageCookie) in c:\local\identity\server3\IdentityServer3\source\Core\Extensions\InternalOwinExtensions.cs:line 436
   at Microsoft.Owin.Host.SystemWeb.CallHeaders.SendingHeadersEvent.Fire()
   at Microsoft.Owin.Host.SystemWeb.OwinCallContext.StartOnce()
   --- End of inner exception stack trace ---
   at Microsoft.Owin.Host.SystemWeb.OwinCallContext.OnStart()
   at Microsoft.Owin.Host.SystemWeb.CallStreams.OutputStream.Start(Boolean force)
   at Microsoft.Owin.Host.SystemWeb.CallStreams.OutputStream.BeginWrite(Byte[] buffer, Int32 offset, Int32 count, AsyncCallback callback, Object state)
   at System.Net.Http.StreamToStreamCopy.TryStartWriteSync(Int32 bytesRead)
   at System.Net.Http.StreamToStreamCopy.StartRead()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Web.Http.Owin.HttpMessageHandlerAdapter.<SendResponseContentAsync>d__20.MoveNext() in c:\local\identity\server3\IdentityServer3\source\Core\Validation\ScopeValidator.cs:line 0

[AndersAbel]

@dmeierotto Opened a new issue #550 for your problem.