ASP.NET CORE 3.1：Azure AD 身份验证在 EDGE 中失败。 身份验证期间无限重定向循环和页面重新加载

Question

I have no issues with chrome. It is the edge browser where I am facing issues. I have tried to clear the cache. Deleted cookies. Reset the browser. Nothing worked. I keep getting infinite loop on login. And it eventually fails with message "We couldn't sign you in. Please try again." . Any help is appreciated.

public void ConfigureServices(IServiceCollection services)
        {
            services.AddCors(options =>
            {
                options.AddPolicy("CorsPolicy",
                    builder => builder.AllowAnyOrigin()
                    .AllowAnyMethod()
                    .AllowAnyHeader());
            });

            services.Configure<OpenIdConnectOptions>(OpenIdConnectDefaults.AuthenticationScheme, options =>
            {
                options.Events.OnRedirectToIdentityProviderForSignOut = async context =>
                {
                    Console.WriteLine("intercepted");
                };
            });

            var azureAd = new AzureAd();
            Configuration.GetSection("AzureAd").Bind(azureAd);
            services.AddControllersWithViews();

            services.AddAuthentication(AzureADDefaults.AuthenticationScheme)
                .AddAzureAD(options => Configuration.Bind("AzureAd", options));

             var url = "https://abc.xyz.com/platform/signin-oidc";
            //var url = "https://localhost:5001/platform/signin-oidc";

            services.Configure<OpenIdConnectOptions>(AzureADDefaults.OpenIdScheme, options =>
            {
                options.SaveTokens = true;


                options.Events = new OpenIdConnectEvents
                {

                    OnRedirectToIdentityProvider = async context =>
                    {
                        context.ProtocolMessage.RedirectUri = url;

                        //context.Response.Headers.Add("Referrer-Policy", "no-referrer");
                        await Task.FromResult(0);
                    }
                };
            });

        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {

            app.UseCors("CorsPolicy");

            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }
            else
            {
                app.UseExceptionHandler("/Home/Error");
                // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                app.UseHsts();
            }

            app.UseHttpsRedirection();
            app.UseStaticFiles();
            //app.UseCookiePolicy();
            app.UseRouting();
            app.UseAuthentication();
            app.UseAuthorization();
            app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllerRoute(
                                   name: "default",
                                   pattern: "{controller=Home}/{action=Index}/{id?}");
                endpoints.MapControllerRoute(
                    name: "platform",
                    pattern: "/platform/{controller=Home}/{action=Index}/{id?}");


            });
        }

EDIT

I do see this in networks tab in developer tools:

Answer 1

The issue was because the token sent back by the AD is stored in a cookie. And the cookie was blocked because it did not have secure attribute.

It did not have secure attribute because the application deployed on Kubernetes Cluster and the communication was http instead of https between front door and the application. So in order to force secure cookies I had to add the following inside public void Configure(IApplicationBuilder app, IWebHostEnvironment env) :

        app.UseForwardedHeaders(new ForwardedHeadersOptions
        {
            ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
        });

        app.Use(async (context, next) =>
        {
            if (context.Request.Host.Host.ToLower() != "localhost")
                context.Request.Scheme = "https";
            await next.Invoke();
        });