MVC5 Facebook Authentication - Account/ExternalLoginCallback?error=access_denied#_=_

Question

Why am I able to successfully login via Facebook when debugging and running application as localhost but not after publishing to 1and1.com?

I have been at this for almost a week. I have tried everything in every forum I've read with little success. The problem is, it is working when running as localhost, but fails when published to my production site. The production site is hosted by 1and1.com. What's confusing is I was able to authenticate in the production environment once; but not since. The entire project is almost all the default setup when creating a new MVC Web Application in visual Studio 2017. Here's the entire setup:

Facebook App Settings:

App Domains: smarthomeprodealer.com
Site URL: https://smarthomeprodealer.com
Client OAuth Login: Yes
Web OAuth Login: Yes
Force Web OAuth Reauthentication: Yes
Use Strict Mode for Redirect URIs: Yes
Enforce HTTPS: Yes
Embedded Browser OAuth Login: No
Valid OAuth Redirct URIs: https://smarthomeprodealer.com/ https://smarthomeprodealer.com/signin-facebook https://localhost:44300/ https://localhost:44300/signin-facebook

Startup.Auth.cs

public partial class Startup
{
    public void ConfigureAuth(IAppBuilder app)
    {
        app.CreatePerOwinContext(ApplicationDbContext.Create);
        app.CreatePerOwinContext(ApplicationUserManager.Create);
        app.CreatePerOwinContext(ApplicationSignInManager.Create);

        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            LoginPath = new PathString("/Account/Login"),
            Provider = new CookieAuthenticationProvider
            { 
                OnValidateIdentity = SecurityStampValidator.OnValidateIdentity(
                    validateInterval: TimeSpan.FromMinutes(30),
                    regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
            }
        });            
        app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);

        app.UseFacebookAuthentication(new FacebookAuthenticationOptions
        {
            AppId = "*************",
            AppSecret = "*********************************",
            SignInAsAuthenticationType = DefaultAuthenticationTypes.ExternalCookie, 
            Provider = new FacebookAuthenticationProvider
            {
                OnAuthenticated = context =>
                {
                    context.Identity.AddClaim(new Claim("FacebookAccessToken", context.AccessToken));
                    foreach (var claim in context.User)
                    {
                        var claimType = $"urn:facebook:{claim.Key}";
                        var claimValue = claim.Value.ToString();
                        if (!context.Identity.HasClaim(claimType, claimValue))
                            context.Identity.AddClaim(new Claim(claimType, claimValue, "XmlSchemaString", "Facebook"));
                    }
                    return Task.FromResult(0);
                }
            }
        });
    }
}

AccountController.cs

    [AllowAnonymous]
    public async Task ExternalLoginCallback(string returnUrl, string error)
    {
        if (error != null)
        {
            return this.View("Error");
        }

        var loginInfo = await this.AuthenticationManager.GetExternalLoginInfoAsync();
        if (loginInfo == null)
        {
            this.ModelState.AddModelError("", "Failed to get external login info.");
            return this.RedirectToAction("Login");
        }

        // Sign in the user with this external login provider if the user already has a login
        var result = await this.SignInManager.ExternalSignInAsync(loginInfo, isPersistent: false);
        switch (result)
        {
            case SignInStatus.Success:
                return this.RedirectToLocal(returnUrl);
            case SignInStatus.LockedOut:
                return this.View("Lockout");
            case SignInStatus.RequiresVerification:
                return this.RedirectToAction("SendCode", new { ReturnUrl = returnUrl, RememberMe = false });
            case SignInStatus.Failure:
            default:
                // If the user does not have an account, then prompt the user to create an account
                this.ViewBag.ReturnUrl = returnUrl;
                this.ViewBag.LoginProvider = loginInfo.Login.LoginProvider;
                ExternalLoginConfirmationViewModel viewModel = null;
                if (string.Equals(loginInfo.Login.LoginProvider, "facebook", StringComparison.CurrentCultureIgnoreCase))
                {
                    var identity = this.AuthenticationManager.GetExternalIdentity(DefaultAuthenticationTypes.ExternalCookie);
                    var email = loginInfo.Email;
                    var firstName = identity.FindFirstValue("urn:facebook:first_name");
                    var lastName = identity.FindFirstValue("urn:facebook:last_name");
                    viewModel = new ExternalLoginConfirmationViewModel
                    {
                        Email = email,
                        FirstName = firstName,
                        LastName = lastName
                    };
                }

                if (viewModel == null)
                {
                    viewModel = new ExternalLoginConfirmationViewModel { Email = loginInfo.Email };
                }
                return this.View("ExternalLoginConfirmation", viewModel);
        }
    }

packages.config

I successfully get Facebook's authentication window to open, but after clicking continue I get the following network calls:

General

    Request URL: https://smarthomeprodealer.com/signin-facebook?code=AQDBJtnrFRAOWXlsP-XwPpGYmOck3299lBcir6-W-1pK_jZDkKELCflt91yJ_RJQ5hChBUBgvxa6X-ZPxuCDiojdQOMiSOlxAdS6-3IUmGqCwfEqgROmnZF2WD3xsdZJNgRctbsR5-DPWcNUunB4Nmi0Z2fLPb6Cz7_kozK3MRRSuEiKDwfStUHeP_Hb07IZYXYQcDzq5XuR8FB-ZUDn4LLGoMgVQQ-O96FIvt7d_Yrm1_-THCk94HBdBRWlUyVXWBTFCssBZt7h5rE2lxqBnNREmEHXZgYaEDPDIAXA7Evp_M7tUu-BnkjJp1KojzXtcrcvCzV2oFflFy33gZr6kWvo&state=VctNDgrl9b6gQpcRUucyMLSWedxDOr6yhbmvlGRD37mWbVgAuW2p1nFbBkzJzIMjaXF65YKpKzEDiTYrSJDpVRnZIRyjiUnL-JW3Y6-evmerqysAezMENlneW3i3bvkH4f6BAvAMJw0C7SC6B2E2zlcGqvYJZvp0hlFqJbI1KhgMlozrChZcEFlYU0_leEXAp7JiwokC0ZloyRN9o3YA4siHolsHIR1tcOKnAoHSYaU
    Request Method: GET
    Status Code: 302 
    Remote Address: 74.208.236.203:443
    Referrer Policy: origin-when-cross-origin

Response Headers

content-length: 0
date: Fri, 24 Aug 2018 23:52:41 GMT
location: /Account/ExternalLoginCallback?error=access_denied
server: Microsoft-IIS/10.0
set-cookie: .AspNet.Correlation.Facebook=; path=/; expires=Thu, 01-Jan-1970 00:00:00 GMT
status: 302
x-powered-by: ASP.NET

Request Headers

:authority: smarthomeprodealer.com
:method: GET
:path: /signin-facebook?code=AQDBJtnrFRAOWXlsP-XwPpGYmOck3299lBcir6-W-1pK_jZDkKELCflt91yJ_RJQ5hChBUBgvxa6X-ZPxuCDiojdQOMiSOlxAdS6-3IUmGqCwfEqgROmnZF2WD3xsdZJNgRctbsR5-DPWcNUunB4Nmi0Z2fLPb6Cz7_kozK3MRRSuEiKDwfStUHeP_Hb07IZYXYQcDzq5XuR8FB-ZUDn4LLGoMgVQQ-O96FIvt7d_Yrm1_-THCk94HBdBRWlUyVXWBTFCssBZt7h5rE2lxqBnNREmEHXZgYaEDPDIAXA7Evp_M7tUu-BnkjJp1KojzXtcrcvCzV2oFflFy33gZr6kWvo&state=VctNDgrl9b6gQpcRUucyMLSWedxDOr6yhbmvlGRD37mWbVgAuW2p1nFbBkzJzIMjaXF65YKpKzEDiTYrSJDpVRnZIRyjiUnL-JW3Y6-evmerqysAezMENlneW3i3bvkH4f6BAvAMJw0C7SC6B2E2zlcGqvYJZvp0hlFqJbI1KhgMlozrChZcEFlYU0_leEXAp7JiwokC0ZloyRN9o3YA4siHolsHIR1tcOKnAoHSYaU
:scheme: https
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cache-control: max-age=0
cookie: __RequestVerificationToken=S5Juj1hBkXIjmD-grTT7GznV6FrUMuyGCBmI5JoL9wXGoo3l9PKqscj54umCFGOSuK5pmx6Kjv8ap9QJ8q6ixNF2M9syQkq-iwDchS5m1u81; ASP.NET_SessionId=xaj1bb3qc5mzuefk3imxhhnl; .AspNet.Correlation.Facebook=pfQHMd0GIkxHeDwrLwGzcUdfmCUPPS2tR9G_WFPeueE
dnt: 1
referer: https://www.facebook.com/
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36

Why am I able to successfully login via Facebook when debugging and running application as localhost but not after publishing to 1and1.com?

user_893865 · Answer

I know it's been a while but after troubleshooting with the hosting team, they adviced me to put this in web.cofig and it worked!

MVC5 Facebook Authentication - Account/ExternalLoginCallback?error=access_denied#_=_

1 Answers