Troubleshooting IDX21323: RequireNonce is "System.Boolean" for Okta OIDC Application
Last Updated:
Overview
When using Microsoft OpenID Connect middleware with Google Chrome version 80 or later, an IDX21323 error occurs because the browser drops the nonce cookie when the Secure attribute is missing. Enforcing HTTPS traffic and configuring the application to set the SameSite and Secure cookie attributes resolves this issue. The following error generates during authentication:
IDX21323: RequireNonce is ‘System.Boolean’. OpenIdConnectProtocolValidationContext.Nonce was null, OpenIdConnectProtocol.ValidatedIdToken.Payload.Nonce was not null. The nonce cannot be validated. If you don’t need to check the nonce, set OpenIdConnectProtocolValidator.RequireNonce to ‘false’. Note if a ‘nonce’ is found it will be evaluated.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- ASP.NET Model-View-Controller (MVC) application using Microsoft OpenID Connect middleware
Cause
Microsoft OpenIDConnect middleware uses a nonce cookie to mitigate replay attacks. The middleware throws the IDX21323 exception when it encounters an invalid nonce or a missing nonce cookie.
When an unauthenticated user attempts to access the application at https://example.com/Account/LogOn, the application redirects the request to the configured OpenID provider (Okta) at https://login.example.com/oauth2/default/v1/authorize and sets the OpenIDConnect.nonce cookie as shown in the following network trace.
Upon successful authentication, Okta sends a POST request with an authorization code to the application callback at https://example.com/Account/Logon, which must contain the nonce cookie as demonstrated in the following trace.
The application middleware compares the nonce cookie with the nonce claim in the token, and generates the IDX21323 error if the nonce cookie is missing.
Google Chrome version 80 and later drops cookies with the SameSite=None attribute if the Secure attribute is missing. The Secure attribute requires an HTTPS connection. If the application uses HTTP, Chrome drops the nonce cookie, causing the validation to fail. The Chrome flags configuration displays the SameSite cookie settings.
Solution
What application configuration sets the required cookie attributes?
Enforce HTTPS for all website traffic and configure the application to set the appropriate cookie attributes by implementing one of the following configuration updates.
For ASP.NET applications using OWIN
Update the Startup.cs file to configure the authentication type and cookie attributes.
AuthenticationType = "Cookies", // if it still fails, change it to "ApplicationCookie"
CookieSameSite = SameSiteMode.None,
CookieSecure = CookieSecureOption.AlwaysUpdate the web.config file to require Secure Sockets Layer (SSL) and set the SameSite attribute. NOTE: This step only applies to applications hosted on IIS or IIS Express.
<system.web>
<sessionState cookieSameSite="None"/>
<httpCookies requireSSL="true" />
</system.web>For ASP.NET Core applications
Configure the cookie options directly in the .AddCookie() call.
.AddCookie(options => {
options.Cookie.SameSite = SameSiteMode.None;
options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
options.Cookie.IsEssential = true;
});What infrastructure configurations require verification to ensure HTTPS enforcement?
Verify the infrastructure configuration to ensure HTTPS is enforced across all components by checking the following settings.
- Enable SSL in Visual Studio or the Windows virtual machine (VM) to enforce HTTPS.
- Configure proxies or load balancers to use HTTPS. For example, an Amazon Web Services (AWS) load balancer must use port 443 for communication between the load balancer and the application server.
- Apply an iRule to set the nonce cookie with
SameSite=Noneand theSecureattribute when using an F5 load balancer.
