0
640
ViewsAsp.net Core MVC application with Azure AD authentication. Unable to unprotect Message.State on browser back button
I have a ASP.NET Core 3.1 MVC application which is integrated with AZURE AD for authentication. The problem is that when redirecting between the pages it issues a request to a url something similar to :
https://login.microsoftonline.com/e3a291d3-8a20-4c35-8d08-38ffcafa479d/oauth2/authorize?client_id=86cda223-2296-46c3-a...
it automatically authenticated and next page loads perfectly fine. but if I press back button then it gets redirected back to this weird login url. And that's when it throws exception.
1 answers
Answer question0
One of the workarounds that you can try is to add reply / redirect url to your app in Azure Ad as so, The Reply URL will deliver the authentication response, which will include a token if authentication is successful. Aslo try adding the PostLogoutRedirectURI in your appSettings where Azure AD will redirect the user-agent in an OAuth 2.0 request.
For Adding Reply URL you can navigate to Settings > Reply URLs and set the URL to the page where the user will be directed after logging in.
REFERENCE: Reply URLs vs PostLogoutRedirectURIs in Azure Active Directory (AAD) | by Marilee Turscak
Here is a similar Thread you can refer to Error code "Unable to unprotect the message.State" when redirecting