0

I'm building a ASP.NET Core Web App (Razor Pages) application and I am trying to add external authentican providers. I have succesfully added the Microsoft provider, and am working on the Facebook provider, following these suggested steps.

https://learn.microsoft.com/en-us/aspnet/core/security/authentication/social/facebook-logins?view=aspnetcore-8.0

My code:

builder.Services.AddAuthentication()
    .AddMicrosoftAccount(options =>
    {
        options.ClientId = ...;
        options.ClientSecret =  ...;
    })
    .AddFacebook(options =>
    {
        options.AppId = ...;
        options.AppSecret = ...;
    });

When running on my local dev client, everything seems to work fine: My test user can add Facebook as an external login, and use it to log in to the application.

However, it fails when the same application is running on Azure. Upon completing the Facebook side of the authentication process, it redirects to the (correct) return page, which fails with a 500 error.

https://abcxyz.azurewebsites.net/signin-facebook?code=AQBe...74Glf8#_=_

Sadly, I'm not getting very tasty info from the Azure Application Logs, just what appears to be an IIS-generated error page:

HTTP Error 500.0 - Internal Server Error The page cannot be displayed because an internal server error has occurred. ... The Requested URL https://AbcXyz:80/signin-facebook?code=AQBe...74Glf8 ... Information:This error means that there was a problem while processing the request. The request was received by the Web server, but during processing a fatal error urred, causing the 500 error.

I'm at a loss as to identifying what is the cause of the failure, so I'm left at guessing that my client is able to performs some sort of undisclosed back-channel operation towards Facebook that my Azure App Service instance is blocked from.

Is there some details I've missed in my application's Facebook configuration? Anything I need to enable in Azure?

Improve this question
8
  • Have you enabled logging for your ASP.NET Core app to see what the remote failure is? That should guide you in the right direction. A typical cause of failure is missing correlation cookies caused by incorrect cookie configuration for Same Site.
    – Martin Costello
    Commented May 29 at 8:33
  • I've been looking at my App Service's Application Log stream, and that is what's told me what I included in the post.
    – Sigurd Garshol
    Commented May 29 at 8:48
  • Once the code parameter was received, the application has to make an API call, to exchange that code for an access token - and my guess would be, that things go wrong in that step, due to the API response. But you'll really have to see that you get some more detailed information about the error.
    – CBroe
    Commented May 29 at 9:30
  • 1
    Glad you fixed it...but: You need to post your solution in the Answers section below. The answer is not part of the question! Right now, no-one can search for your solution or vote on it, because to the search engine it looks like (part of) a question. Please take the tour to ensure you understand how Stackoverflow's question-and-answer format works. The Can I answer my own question? and How to Answer articles from the help centre are also relevant. Once you've added an answer properly, you should also roll back the edit to the question. Thanks.
    – ADyson
    Commented May 29 at 11:40
  • 1
    Alternatively if you believe this was a trivial mistake or typo which means the solution is unlikely to be of any interest to others in future, then you should simply delete the question. Either way, don't leave it hanging open and unanswered!
    – ADyson
    Commented May 29 at 11:40

1 Answer 1

Reset to default
0

I got it solved!

It turns out that I had made a mistake when saving the AppSecret to Azure Key Vault, including a buch of extra characters! Specifically, I had accidentally copied the whole line from my secrets.json file and pasted that in as the secret value.

I didn't notice it in review because the secret is masked and I just assumed it was correct.

Using the correct AppSecret without all the junk characters allowed it to work as intended!

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.