.NET 6 External Login Providers redirect as local URL

Viewed 52

Im using .NET 6 with external authentification methods (Facebook,Steam (which relies on OpenID).

Suddenly after my latest pushes the "Challenge" method redirects to an local url instead of as usual to the actual host (steam or facebook). However the path portion of the url is still correct:

As example for steam: The correct url should be: https://steamcommunity.com/openid/login?openid.claimed_id... But the host gets missing somewhere so the redirect ends up as "https://myhost.com/openid/login?openid.claimed_id..."

Same for facebook. Below the code how I call the Challenge method:

[HttpGet("connection/{key}")]
        [UseTransaction]
        public async Task<IActionResult> Connection(string key, string callback = "/")
        {
            if (!this.Url.IsLocalUrl(callback))
            {
                callback = "/";
            }

            callback = callback.Trim();

            callback = this.Url.AbsoluteContent(callback);
            // If we have this login on user we disconnect otherwhise we connect

            IList<UserLoginInfo> logins = await this.userManager.GetLoginsAsync(this.IdentityUser);

            if (logins.Any(l => l.LoginProvider.ToLower() == key.ToLower()))
            {
                UserLoginInfo info = logins.First(l => l.LoginProvider.ToLower() == key.ToLower());

                IList<Claim> claims = await this.userManager.GetClaimsAsync(this.IdentityUser);

                IList<Claim> providerClaims = claims.Where(x => x.Subject?.AuthenticationType == info.LoginProvider).ToList();

                IEnumerable<AuthenticationScheme> schemes = await this.signInManager.GetExternalAuthenticationSchemesAsync();
                // Now check if we have a disconnect endpoint on the API Side.
                if (providerClaims.Any(x => x.Type == "urn:disconnect:endpoint"))
                {
                    // Get Fresh Token
                    string scheme = schemes.First(x => x.Name.ToLower() == key.ToLower()).Name;

                    string cbUri = $"/{this.RouteData.Values["language"]}/api/front/account/ConnectionDeletionCallback/{key.ToLower()}?redirect_uri={HttpUtility.UrlEncode(callback)}";

                    var properties = this.signInManager.ConfigureExternalAuthenticationProperties(scheme, cbUri);

                    return Challenge(properties, scheme);
                }
                else
                {
                    bool deletion = await this.deleteConnectionData(providerClaims, info.LoginProvider, info.ProviderKey);

                    return Redirect(callback);
                }
            }
            else
            {
                IEnumerable<AuthenticationScheme> schemes = await this.signInManager.GetExternalAuthenticationSchemesAsync();

                if (!schemes.Any(x => x.Name.ToLower() == key.ToLower()))
                {
                    return this.NotFound();
                }

                string scheme = schemes.First(x => x.Name.ToLower() == key.ToLower()).Name;

                string cbUri = $"/{this.RouteData.Values["language"]}/api/front/account/ConnectionCallback?redirect_uri={HttpUtility.UrlEncode(callback)}";

                var properties = this.signInManager.ConfigureExternalAuthenticationProperties(scheme, cbUri);

                return Challenge(properties, scheme);
            }
        }

I did nothin but updating a few packages. The 2 Packages for the external login were not part of it except the facbook one I updated from 6.0.4 to 6.0.8.

For facebook I use: Microsoft.AspNetCore.Authentication.Facebook 6.0.8

And for Steam: AspNet.Security.OpenId.Steam 6.0.0

The application is running inside docker windows containers. The .net core main packages got all updated to latest. Docker image based on mcr.microsoft.com/dotnet/sdk:6.0-windowsservercore-ltsc2019 The redirect works fine on my local docker env.

Also Im using ARR3 behind an IIS as reverse proxy.

1 Answers

I finally found it. Since I use IIS and ARR3 together with URlRewrite:

The Problem here was that I enabled preserveHostHeader (IIS AAR - URL Rewrite for reverse proxy - how to send HTTP_HOST) and enabled "Rewrite Host Header". This caused also the location header to be rewritten regarding my outbound rules.

However disabling this option had no side effect so far. Found no solution so far to make this option conditional.

Related