dotnet/aspnetcore

Log decryption failures

开放

#4,651 创建于 2018年6月1日

 (2 条评论) (0 个反应) (0 位负责人)C# (10,653 个派生)batch import
affected-mediumarea-authenhancementhelp wantedseverity-minor

仓库指标

星标
 (37,933 个星标)
PR 合并指标
 (PR 指标待抓取)

描述

"Correlation failed" is one of the most common failures in OIDC or OAuth flows. Many of the things that can go wrong here happen on the client and can't be traced from the server. However there's one scenario where everything does flow back to the server and the server fails to decrypt the values. This can happen in a multi-node environment with misconfigured dataprotection (RE: https://github.com/aspnet/Security/issues/1755). We can highlight this by logging decryption failures in OAuth, OIDC, and CookieAuth.

贡献者指南