title: ASP.NET Framework v4 App using OpenIDConnect and Session[] variables will not authenticate the second session
body: <p>I have an .NET Famework 4.7.1 ASP.Net/MVC application that I am switching from SAML to a new OpenIDConnect Identity Provider.  The original code used libraries from the SAML provider and was used Framework 4.5.  I upgraded to 4.7.1 and added OWIN. </p>
  
  <p>Everything seemed to working well until I put the app into production.  At that point only the first person to sign in could get in.  Anyone else that started a new session would simply get caught in a redirect loop between the site and the IP until the Nonce cookies filled up the request and they got a "Request Too Long" error.</p>
  
  <p>I have other apps that I have setup using this IP and ASP.Net Framework and I'm not having a problem.  This app is Framework 4.5 but was designed from the beginning to use OWIN and <a href="https://www.nuget.org/packages/Kentor.AuthServices/" rel="nofollow noreferrer">Kentor.AuthServices</a> for SAML and the conversion to OpenIDConnect was very smooth.</p>
  
  <p>The support from my IP and I followed the conversation between my app and the IP and the token is being sent back correctly.  I added the Notifications to the Authentication and put in breakpoints.  The app is getting the token and validating it.  </p>
  
  <p>I tried going back to Framework 4.5 and making all the libraries the same version as the other app that is working.  That didn't work.</p>
  
  <p>I finally tracked it down to the use of Session[] variables.  I was also able to recreate the issue with a new .NET ASP.NET application.</p>
  
  <ol>
  <li>Create a new "ASP.NET Web Application" Framework 4.7.1 with no Authentication.  (You can start with their authentication but it doesn't help)</li>
  <li>Install NuGet Package "Microsoft.Owin.Host.SystemWeb"  (v4.0.0.0)</li>
  <li>Install NuGet Package "Microsoft.Owin.Security.OpenIdConnect" (v4.0.0.0)</li>
  <li>Install NuGet Package "Microsoft.Owin.Security.Cookies" (v4.0.0.0)</li>
  <li><p>Create Startup.cs</p>
  
  <blockquote>
    <p>using Microsoft.Owin;
       using Owin;
       using System;
       using Microsoft.Owin.Security.Cookies;
       using System.Configuration;
       using System.Collections.Specialized;
       using Microsoft.Owin.Security.OpenIdConnect;
       using Microsoft.IdentityModel.Protocols.OpenIdConnect;
       using Microsoft.Owin.Security;
       [assembly: OwinStartupAttribute(typeof(WebApplication.Startup))]
       namespace WebApplication
       {
           public partial class Startup
           {
               public void Configuration(IAppBuilder app)
               {
              app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);</p>
  
  <pre><code>       app.UseCookieAuthentication(new CookieAuthenticationOptions{});
         app.UseOpenIdConnectAuthentication(
             new OpenIdConnectAuthenticationOptions
             {
                 ClientId = "{clientid}",
                 Authority = "{IP authority}",
                 ResponseType = OpenIdConnectResponseType.CodeIdTokenToken,
                 Scope = OpenIdConnectScope.OpenIdProfile + " " + OpenIdConnectScope.Email,
             });
  
         }
     }
  </code></pre>
    
    <p>}</p>
  </blockquote></li>
  <li><p>Modify HomeController.cs</p>
  
  <blockquote>
    <p>public class HomeController : Controller
       {
           public ActionResult Index()
           {
               return View();
           }</p>
  
  <pre><code>   public ActionResult About()
     {
  
         ViewBag.Message = "Your application description page.";
  
         // Added this line ****************
         Session["Value"] = "Test Value";
  
         return View();
     }
  
     // Added this line ****
     [Authorize] 
     public ActionResult Contact()
     {
         ViewBag.Message = "Your contact page.";
  
         return View();
     }
  </code></pre>
    
    <p>}</p>
  </blockquote></li>
  </ol>
  
  <p>To exhibit the problem follow these steps</p>
  
  <ol>
  <li>Run the web app and go to the Contact page.  You will either already be Authenticated or you will need to sign in.</li>
  <li>Open another browser or a private/incognito page so you get a new session and open the site.  Go to the Contact page.  You will need to sign in again.  </li>
  </ol>
  
  <p>You can see the authentication works for both sessions.  </p>
  
  <ol start="3">
  <li>Close the second browser/private/incognito window. </li>
  <li>Return to the first browser and go to the About page.  This is the page with the Session[] assignment</li>
  <li>Open a new browser/private/incognito window.  Return to the Contact page on the site.  You will be asked to the authenticate again.  </li>
  </ol>
  
  <p>After you authenticate, the browser will begin a redirect loop between the site and your IP authentication.</p>
  
  <p>It doesn't matter if the [Authorize] attribute is on the controller or the action.
  It doesn't matter if there is a client secret assigned in the OpenIdConnect options.
  I added a Session[] variable to the other app that is working and it started having the same issue.</p>
  
  <p>Other than removing all Session[] variables, is there something I can do to stop this behavior?</p>
  
  <p>I know this is a long post. Thanks for reading to the end and 
  thank you for any help.</p>