We have a web app working with ASP.NET Core 6 for the backend and Angular 9 for the frontend.
Everything is fine except for one user, who is using the web app via Citrix. Intermittently, the user cannot access to the App. His Chrome Browser Console shows an Error that is apparently sent from our backend:
zone.js:3324 POST our.api.url net::ERR_CERT_AUTHORITY_INVALID
We suspect Citrix is doing something to the request, which now contains:
"Sec-Fetch-Site": ["cross-site"],
We use authentication as follows:
services.AddAuthentication(options =>
{
options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddCookie(cfg => cfg.SlidingExpiration = true)
.AddJwtBearer(cfg =>
{
cfg.RequireHttpsMetadata = false;
cfg.SaveToken = true;
cfg.TokenValidationParameters = new TokenValidationParameters
{
ValidIssuer = configuration.GetValue<string>("token-issuer"),
ValidAudience = configuration.GetValue<string>("token-issuer"),
IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(configuration.GetValue<string>("token-key")))
};
});
We have also implemented CORS restricted to some origins.