Asp.net core 3 Identity server 4 application crash Stack Overflow

Question

I have an Identity server 4 using Asp.net core. The application crash after browsing. I am using the CMD to run the application

macbooks-MacBook-Air:Falcon-Identity macbook$ dotnet run
[20:52:42 Information] 
Starting host...

info: IdentityServer4.Startup[0]
      Starting IdentityServer4 version 4.0.0+1acafade44176bf817412aa4309d5dff6587a741
info: IdentityServer4.Startup[0]
      You are using the in-memory version of the persisted grant store. This will store consent decisions, authorization codes, refresh and reference tokens in memory only. If you are using any of those features in production, you want to switch to a different store implementation.
info: IdentityServer4.Startup[0]
      Using the default authentication scheme Identity.Application for IdentityServer
info: Microsoft.Hosting.Lifetime[0]
      Now listening on: https://localhost:5001
info: Microsoft.Hosting.Lifetime[0]
      Now listening on: http://localhost:5000
info: Microsoft.Hosting.Lifetime[0]
      Application started. Press Ctrl+C to shut down.
info: Microsoft.Hosting.Lifetime[0]
      Hosting environment: Development
info: Microsoft.Hosting.Lifetime[0]
      Content root path: /Users/macbook/Projects/Falcon-Identity/Falcon-Identity
Stack overflow.
macbooks-MacBook-Air:Falcon-Identity macbook$ 

When I am browsing the URL https://localhost:5001 Keep getting the stack overflow error, but don't know what's causing the issue.

Startup.CS

public class Startup
    {
        public IConfigurationRoot Configuration { get; }
        public IWebHostEnvironment Environment { get; }
        public Startup(IWebHostEnvironment environment)
        {
            Environment = environment;
            var builder = new ConfigurationBuilder()
                .SetBasePath(Environment.ContentRootPath)
                .AddJsonFile("appsettings.json", optional: true, reloadOnChange: true)
                .AddEnvironmentVariables();
            Configuration = builder.Build();
        }

        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {
            services.AddControllersWithViews();
            services.AddIdentityServer(Configuration);
            services.ConfigureCors();
            services.ConfigureExternalOidcProvider();
            services.AddAutoMapper(typeof(Startup));
            services.AddTransient<EmailHelper>();
            services.AddTransient<ITemplateHelper, TemplateHelper>();
            services.SwaggerConfig();
            services.ConfigureGlobalExceptionFilter();
            // In production, the React files will be served from this directory
            services.AddSpaStaticFiles(configuration => { configuration.RootPath = "ClientApp/build"; });
            services.AddControllersWithViews().AddRazorRuntimeCompilation();
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }
            else
            {
                app.UseExceptionHandler("/Error");
                // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                //app.UseHsts();
            }

            //app.ConfigureCsp();
            app.UseHttpsRedirection();
            app.UseStaticFiles();
            app.UseSpaStaticFiles();
            app.UseIdentityServer();
            app.UseMongoDbForIdentityServer();
            // Enable middleware to serve generated Swagger as a JSON endpoint.
            app.UseSwagger();
            // Enable middleware to serve swagger-ui (HTML, JS, CSS, etc.),
            // specifying the Swagger JSON endpoint.
            app.UseSwaggerUI(c =>
            {
                c.SwaggerEndpoint("/swagger/v1/swagger.json", "My API V1");
            });
            app.UseRouting();
            app.UseAuthorization();
            app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllerRoute(
                    name: "default",
                    pattern: "{controller}/{action=Index}/{id?}");
            });

            app.UseSpa(spa =>
            {
                spa.Options.SourcePath = "ClientApp";

                if (env.IsDevelopment())
                {
                    spa.UseReactDevelopmentServer(npmScript: "start");
                }
            });
            
        }
    }

Answer 1

Might be the same problem I had. Microsoft.AspNetCore.Identity is calling SignInManager.SignOutAsync when the session cookie expires or is invalid which gets picked up by the Identity Server to log the user out on all the clients the user is logged in. If the cookie is invalid, then you are not authenticated, and the Identity Server tries to authenticat you in order to get the list of clients you are logged in and you end up with this stack overflow.

How can you fix this?

As a dirty quick fix, you can add a class that looks like this:

public class FixedDefaultUserSession : IdentityServer4.Services.DefaultUserSession
{
    bool _authenticateAsyncRunning = false;

    public NewDefaultUserSession(IHttpContextAccessor httpContextAccessor, IAuthenticationHandlerProvider handlers, IdentityServerOptions options, ISystemClock clock, ILogger<IUserSession> logger)
        : base(httpContextAccessor, handlers, options, clock, logger)
    {
    }

    protected override Task AuthenticateAsync()
    {
        if (_authenticateAsyncRunning)
            return Task.CompletedTask;

        try
        {
            _authenticateAsyncRunning = true;

            return base.AuthenticateAsync();

        }
        finally
        {
            _authenticateAsyncRunning = false;
        }
    }
}

And register this instead of the DefaultUserSession service in the ConfigureServices like this:

services.RemoveAll<IdentityServer4.Services.IUserSession>();
services.AddScoped<IdentityServer4.Services.IUserSession, FixedDefaultUserSession>();

After that it should at least work. But I think this issue will be fixed in v4.0.5 or later. See this issue: https://github.com/IdentityServer/IdentityServer4/issues/4844