400 Bad Request (Header Size) error when using Entra ID SSO for users from specific tenant #23
-
Which version of Duende IdentityServer are you using? Which version of .NET are you using? Describe the bug This does not occur consistently for all Entra ID SSO users, only specific tenants. The URL when the error occurs is as follows: To Reproduce Scenario 1. Scenario 2. Expected behavior Scenario 1. Scenario 2. Log output/exception with stacktrace We do not see any further details in the available logs - we only see the screen with 400 Bad Request. It seems the request does not reach the Application logs. Additional context We have attempted to increase header size limits via IIS config (at the IIS level, and ID Server site level). |
Beta Was this translation helpful? Give feedback.
Replies: 3 comments 4 replies
-
(note: we're moving this issue to our new community discussions) |
Beta Was this translation helpful? Give feedback.
-
Can you please specify exactly what endpoint is redirected to and what header values are present? If the cookies are large, what are the names of the cookies? |
Beta Was this translation helpful? Give feedback.
-
Please refer to below screenshot to see the endpoint / error |
Beta Was this translation helpful? Give feedback.
Thanks for the answer. The cookies are indeed large and that explains why this fails.
First, even though you are in the middle of a new sign in flow, there is also an existing previous session available (The .AspNetCore.Identity.Application) session. I would recommend to call SignOutAsync as part of the Challenge() method to logout of any existing session before initiating the new login.
Then the large external cookie can depend on a few things. If you have SaveTokens=true, the received tokens are stored in the cookies. If you do not need the tokens, I would suggest changing to SaveTokens=false. Note that Entra Id as far as I know doesn't use the id_token_hint parameter on logout so there…