I have a strange issue with IdentityServer, during redirect to IS, I see an 500 and in logs:

2022-12-08T00:04:31.7333120+00:00 [INF] (Sitecore Identity/xxxx) Route matched with "{action = \"Login\", controller = \"Account\"}". Executing controller action with signature "System.Threading.Tasks.Task`1[Microsoft.AspNetCore.Mvc.IActionResult] Login(System.String)" on controller "Sitecore.Plugin.IdentityServer.Controllers.AccountController" ("Sitecore.Plugin.IdentityServer").
2022-12-08T00:04:31.7351761+00:00 [INF] (Sitecore Identity/xxxxx) Executing action method "Sitecore.Plugin.IdentityServer.Controllers.AccountController.Login (Sitecore.Plugin.IdentityServer)" - Validation state: Valid
2022-12-08T00:04:31.7446769+00:00 [INF] (Sitecore Identity/xxxx) Executed action method "Sitecore.Plugin.IdentityServer.Controllers.AccountController.Login (Sitecore.Plugin.IdentityServer)", returned result "Microsoft.AspNetCore.Mvc.ViewResult" in 0.1069ms.
2022-12-08T00:04:31.7461571+00:00 [INF] (Sitecore Identity/xxxx) Executed action "Sitecore.Plugin.IdentityServer.Controllers.AccountController.Login (Sitecore.Plugin.IdentityServer)" in 11.7482ms
2022-12-08T00:04:31.7491966+00:00 [ERR] (Sitecore Identity/xxxx) An unhandled exception has occurred while executing the request.
System.InvalidOperationException: Invalid non-ASCII or control character in header: 0x0009
   at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpHeaders.ThrowInvalidHeaderCharacter(Char ch)

what could be an issue with it ?

  • Do you have any non-ascii characters on your CM server url?
    – Marek Musielak
    Commented Dec 8, 2022 at 8:29
  • @MarekMusielak it looks like my2-some.site.com noting special I checked it seems fine. IS url seems ok as well Commented Dec 8, 2022 at 8:57
  • 1
    If you look up the code 0x0009 it is HT (Horizontal Tab). So im guessing you might have copied and pasted the user name or password and accidentally copied a tab character? Commented Dec 8, 2022 at 9:43

1 Answer 1


Dean were right it was hard to catch char at AllowedCorsOriginsGroup1


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.