Authorize GitHub causes infinite redirects or Correlation failed

[Tratcher]

Trying to directly authorize one of the redirecting middleware causes infinite loops. This only works for middleware that directly contain the identity like Cookies or Bearer. We should throw NotSupportedException if you try to call AuthorizeAsync("GitHub").

[Authorize(ActiveAuthenticationSchemes = "GitHub-AccessToken")]

Chrome gets infinite redirects. IE does as well, but sometimes gets:

System.Exception: Failed to retrieve access token.
 AggregateException: Unhandled remote failure. (Failed to retrieve access token.)
Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler`1.<HandleRemoteCallbackAsync>d__5.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler`1.<HandleRequestAsync>d__4.MoveNext()

Which appears to be caused by rate limiting.

Edge gets a different error:

• System.Exception: Correlation failed.
• AggregateException: Unhandled remote failure. (Correlation failed.)
o   Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler`1.<HandleRemoteCallbackAsync>d__5.MoveNext()
o   --- End of stack trace from previous location where exception was thrown ---
o   System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
o   System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
o   Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler`1.<HandleRequestAsync>d__4.MoveNext()
o   --- End of stack trace from previous location where exception was thrown ---
o   System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
o   System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
o   Microsoft.AspNetCore.Authentication.AuthenticationMiddleware`1.<Invoke>d__18.MoveNext()
o   --- End of stack trace from previous location where exception was thrown ---
o   Microsoft.AspNetCore.Authentication.AuthenticationMiddleware`1.<Invoke>d__18.MoveNext()
o   --- End of stack trace from previous location where exception was thrown ---
o   System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
o   System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
o   Microsoft.AspNetCore.Authentication.AuthenticationMiddleware`1.<Invoke>d__18.MoveNext()
o   --- End of stack trace from previous location where exception was thrown ---
o   Microsoft.AspNetCore.Authentication.AuthenticationMiddleware`1.<Invoke>d__18.MoveNext()
o   --- End of stack trace from previous location where exception was thrown ---
o   System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
o   System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
o   Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.<Invoke>d__7.MoveNext()

[Tratcher]

The middleware that do not contain an identity could also call AuthorizeAsync(SignInScheme) internally to retrieve the identity instead of throwing.

[Eilon]

@Tratcher does this seem RC2-worthy? How easy is it to hit this?

[Tratcher]

No, this is a design / mis-use issue. We need to refine the design and/or provide better guidance.

[Eilon]

Ah ok.

[Tratcher]

Related to: #667