Best approach to intermittent "the nonce was null" error

user_25216 0
Viewed 1041

I have an ASP.NET application that validates the user using a separate identity provider (using the OpenID Connect protocol.)

Users are complaining of an itermittent error:

Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolInvalidNonceException: IDX21323: RequireNonce is '[PII is hidden]'. OpenIdConnectProtocolValidationContext.Nonce was null, OpenIdConnectProtocol.ValidatedIdToken.Payload.Nonce was not null. The nonce cannot be validated. If you don't need to check the nonce, set OpenIdConnectProtocolValidator.RequireNonce to 'false'. Note if a 'nonce' is found it will be evaluated.

Users experience this error, then discover if they try the login process again it works.

I can reproduce this error by initiating the login process, and while on the identity provider page, clearing the cookie prefixed with OpenIdConnect.nonce.

The error messages suggests setting OpenIdConnectProtocolValidator.RequireNonce to false. I believe this to be an unsatisfactory solution, because it would make the site vulnerable to replay attacks.

Is there a "best practice" way for the website to gracefully deal with this error?

openid-connect asp.net-mvc
2 Answers

Sometimes the inelegant solution is all you need.

I just display an error, and ask the user to try again.

enter image description here

I suspect the typical user will read the words "Sign In Error", read half of the first sentence, and then click on the button without a second thought.

user_252160

We thought ours was an intermittent problem but it turned out to be just links coming from Office applications like Word, Excel, PowerPoint. I added a rewrite rule to the web.config file and the error immediately went away:

<rule name="WordBypass" enabled="true" stopProcessing="true">
    <match url=".*" />
    <conditions>
        <add input="{HTTP_USER_AGENT}" pattern="Word|Excel|PowerPoint|ms-office" />
    </conditions>
    <action type="CustomResponse" statusCode="200" statusReason="Refresh" statusDescription="Refresh" />
</rule>
user_8127350
Related