CODEWITHSUNDEEP
asp.nethttpsasp.net-mvc-5azure-web-roles
udayr
udayr

Reputation: 63

Issue with https on production environment

I have tried many options and this is my last resort to see if any of the community members have any ideas.

I have .NET MVC 5 application in which I use a Filter to force HTTPS on each unsecured request.

Here is the scenario:

  1. Access my application at say, http://portal.mywebsite.com
  2. It is redirected to third party (auth0) SSO provider for authentication. If the user is not already authenticated, he is redirected to the SSO login page.
  3. The user enters valid credentials, authenticated.

The above scenario works perfectly. But the issue is If I access the same application with https say https://portal.mywebsite.com, it fails. To be precise, it fails to retrieve a ExternalIdentity (ExternalCookie) on the server.

public async Task<ActionResult> ExternalLoginCallback(string returnUrl)
    {
        AuthenticationManager.SignOut(DefaultAuthenticationTypes.ExternalCookie);

        var externalIdentity = await AuthenticationManager.GetExternalIdentityAsync(DefaultAuthenticationTypes.ExternalCookie);

        if (externalIdentity == null)
        {
             throw(new Exception("Could not get the external identity. Please check your Auth0 configuration settings and ensure that " +
                                "you configured UseCookieAuthentication and UseExternalSignInCookie in the OWIN Startup class. " +
                                "Also make sure you are not calling setting the callbackOnLocationHash option on the JavaScript login widget."));

        }

        AuthenticationManager.SignIn(new AuthenticationProperties { IsPersistent = true }, CreateIdentity(externalIdentity));
        return RedirectToLocal(returnUrl);
    }

Also, accessing the application with https on my test environment works and not the production environment.

All my web applications are hosted as Azure WebRoles.

I tried Fiddler to watch the requests between working and non-working to see if I can find any useful information in identifying the issue but no success.

Any thoughts or ideas that I could try to help me narrow down the cause?

Thanks in advance!

Upvotes: 1

Views: 444

Answers (1)

udayr
udayr

Reputation: 63

There is a bug in Microsoft's Owin implementation for System.Web. The temporary fix is addressed here at github.com/KentorIT/owin-cookie-saver

Someone had the same issue .AspNetApplicationCookie and ASP.NET_SessionId not created

Upvotes: 1

Related Questions