.net - 在 Asp.Net Web 应用程序中使用 Okta 时，OpenIdConnectProtocolValidationContext.Nonce 为 null

Question

我有一个 .Net Asp.Net WebApplication，我正在尝试将 Okta 用于单点登录功能。除了使用 Google Chrome 80+ 登录时，我的所有代码都在运行和运行。当我登录 Okta 并被调回我的应用程序时，我收到以下错误。以下是我迄今为止尝试过的步骤。这适用于所有其他浏览器，但很可能由于 Chrome 80 年代的 SameSite cookie 属性更改而失败。
“/”应用程序中的服务器错误。

IDX21323: RequireNonce is '[PII is hidden]'.OpenIdConnectProtocolValidationContext.Nonce was null,OpenIdConnectProtocol.ValidatedIdToken.Payload.Nonce was not null. Thenonce cannot be validated. If you don't need to check the nonce, setOpenIdConnectProtocolValidator.RequireNonce to 'false'. Note if a'nonce' is found it will be evaluated. Description: An unhandledexception occurred during the execution of the current web request.Please review the stack trace for more information about the error andwhere it originated in the code.

异常详情:

Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolInvalidNonceException:IDX21323: RequireNonce is '[PII is hidden]'.OpenIdConnectProtocolValidationContext.Nonce was null,OpenIdConnectProtocol.ValidatedIdToken.Payload.Nonce was not null. Thenonce cannot be validated. If you don't need to check the nonce, setOpenIdConnectProtocolValidator.RequireNonce to 'false'. Note if a'nonce' is found it will be evaluated.

源错误:

An unhandled exception was generated during the execution of thecurrent web request. Information regarding the origin and location ofthe exception can be identified using the exception stack trace below.

堆栈跟踪:

[OpenIdConnectProtocolInvalidNonceException: IDX21323: RequireNonce is'[PII is hidden]'. OpenIdConnectProtocolValidationContext.Nonce wasnull, OpenIdConnectProtocol.ValidatedIdToken.Payload.Nonce was notnull. The nonce cannot be validated. If you don't need to check thenonce, set OpenIdConnectProtocolValidator.RequireNonce to 'false'.Note if a 'nonce' is found it will be evaluated.]
Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolValidator.ValidateNonce(OpenIdConnectProtocolValidationContextvalidationContext) +1374
Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolValidator.ValidateAuthenticationResponse(OpenIdConnectProtocolValidationContextvalidationContext) +219
Microsoft.Owin.Security.OpenIdConnect.d__11.MoveNext()+3770 System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() +27

.Net 版本升级到 4.7.2

将 Microsoft.Owin 的 Nuget 包升级到 4.1

在启动时添加了 SameSite 配置

添加了 web.config 值

添加 CookieManager 代码

Startup.cs配置()代码

app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);


app.UseCookieAuthentication(new CookieAuthenticationOptions()
{
    CookieSameSite = SameSiteMode.None,
    CookieSecure = CookieSecureOption.Always,
    CookieHttpOnly = true,
    CookieManager = new Code.SameSiteCookieManager(new Microsoft.Owin.Host.SystemWeb.SystemWebCookieManager())
});

app.UseOktaMvc(new OktaMvcOptions()
{
    OktaDomain = ConfigurationManager.AppSettings["okta:OktaDomain"],
    ClientId = ConfigurationManager.AppSettings["okta:ClientId"],
    ClientSecret = ConfigurationManager.AppSettings["okta:ClientSecret"],
    RedirectUri = ConfigurationManager.AppSettings["okta:RedirectUri"],
    PostLogoutRedirectUri = ConfigurationManager.AppSettings["okta:PostLogoutRedirectUri"],
    AuthorizationServerId = string.Empty,
    Scope = new List<string> { "openid", "profile", "email" },
});

Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolValidator dd = new Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolValidator();
dd.RequireNonce = false;


//Init ADM Kit and start logging.
Code.KitHelper.Init();

Answer 1

检查您是否仅在 Chrome 中遇到此问题。如果是这样，这将是因为在版本 80 中启动了新的安全实现。
如果启用，没有 SameSite 限制的 cookie 也必须是安全的。如果一个没有 SameSite 限制的 cookie 没有设置 Secure 属性，它将被拒绝。此标志仅在“SameSite by default cookie”也启用时有效。 – Mac、Windows、Linux、Chrome 操作系统、Android
但是，您可以在 chrome://flags 中禁用它，但它现在默认启用
#cookies-without-same-site-must-be-secure
将其设置为禁用后，您必须重新启动 chrome。这解决了我的问题并解释了为什么在生产中每件事都按预期工作，但在本地我收到了 nonce 错误。