Anti-forgery error when opening Identity Server

Question

I am running Sitecore XP 9.2 and installed the Identity Server (IS) without SSL.

Opening (e.g.) http://identity/.well-known/openid-configuration and retrieving tokens works fine. But I get an error while opening the IS homepage, e.g. http://identity.

The full error from the IS log is:

System.InvalidOperationException: The antiforgery system has the configuration value AntiforgeryOptions.Cookie.SecurePolicy = Always, but the current request is not an SSL request.
   at Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgery.CheckSSLConfig(HttpContext context)
   at Microsoft.AspNetCore.Mvc.ViewFeatures.AntiforgeryExtensions.GetHtml(IAntiforgery antiforgery, HttpContext httpContext)
   at Microsoft.AspNetCore.Razor.TagHelpers.TagHelper.ProcessAsync(TagHelperContext context, TagHelperOutput output)
   at Microsoft.AspNetCore.Razor.Runtime.TagHelpers.TagHelperRunner.RunAsync(TagHelperExecutionContext executionContext)
   at Microsoft.AspNetCore.Mvc.Razor.RazorView.RenderPageCoreAsync(IRazorPage page, ViewContext context)
   at Microsoft.AspNetCore.Mvc.Razor.RazorView.RenderAsync(ViewContext context)
   at Microsoft.AspNetCore.Mvc.ViewFeatures.ViewExecutor.ExecuteAsync(ViewContext viewContext, String contentType, Nullable`1 statusCode)
   at Microsoft.AspNetCore.Mvc.ViewFeatures.ViewExecutor.ExecuteAsync(ActionContext actionContext, IView view, ViewDataDictionary viewData, ITempDataDictionary tempData, String contentType, Nullable`1 statusCode)
   at Microsoft.AspNetCore.Mvc.ViewFeatures.ViewResultExecutor.ExecuteAsync(ActionContext context, ViewResult result)
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeResultAsync(IActionResult result)
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeNextResultFilterAsync[TFilter,TFilterAsync]()
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.ResultNext[TFilter,TFilterAsync](State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeResultFilters()
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeNextResourceFilter()
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.Rethrow(ResourceExecutedContext context)
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeFilterPipelineAsync()
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeAsync()
   at Microsoft.AspNetCore.Builder.RouterMiddleware.Invoke(HttpContext httpContext)
   at Microsoft.AspNetCore.Localization.RequestLocalizationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Cors.Infrastructure.CorsMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware.Invoke(HttpContext context)

I ran the IS before without SSL with no problems, so I am a bit puzzled.

Any clues on what setting I missed?

Answer 1

So it is stating that your AntiforgeryOptions.Cookie.SecurePolicy is set to Always. This means, that for the cookie to be provided to the client, the request has to start on HTTPS and stay on HTTPS. However, you should be able override the CookieAuthentication processor in the <owin.initialize> pipeline to allow the authentication cookie to be shared across HTTP requests and not just HTTPS requests. See the Microsoft documentation for further information on CookieAuthenticationOptions.CookieSecure Property and the CookieSecureOption Enumeration.

In the meantime, below is a custom processor you can use to set the CookieSecureOption to Never so that the cookie will be shared on HTTP and HTTPS regardless of where the request started.

public class CustomCookieAuthentication : Sitecore.Owin.Authentication.Pipelines.Initialize.CookieAuthentication
{
    public CustomCookieAuthentication(DefaultCookieAuthenticationOptions cookieAuthenticationOptions, BaseSettings settings)
        : base(cookieAuthenticationOptions, settings)
    {
    }

    public override void Process(InitializeArgs args)
    {
        this.CookieAuthenticationOptions.CookieSecure = CookieSecureOption.Never;
        base.Process(args);
    }
}

You can then patch in your custom processor to the pipeline.

<?xml version="1.0" encoding="utf-8"?>

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/"
               xmlns:role="http://www.sitecore.net/xmlconfig/role/"
               xmlns:security="http://www.sitecore.net/xmlconfig/security/">
  <sitecore role:require="Standalone or ContentDelivery or ContentManagement">
    <pipelines>
      <owin.initialize>
        <processor name="CookieAuthentication">
            <patch:attribute name="type">__Namespace__.CustomCookieAuthentication, __DLL__</patch:attribute>
        </processor>
      </owin.initialize>
    </pipelines>
  </sitecore>
</configuration>

A couple of notes:

• The CookieSecureOption.Never is fine for local development, but you should consider Always or at least SameAsRequest for production servers.
• Remember to change out the __Namespace__ and __DLL__ sections of that config to match your setup.
• Also, I do not have the ability to test this code currently, so keep a keen eye out when trying it out.