SignOut loop in v2.5.0

[michiproep]

Microsoft.Identity.Web Library

Microsoft.Identity.Web.UI

Microsoft.Identity.Web version

2.5.0

Web app

Sign-in users

Web API

Protected web APIs (validating tokens)

Token cache serialization

In-memory caches

Description

Calling the SignOut endpoint in Web.UI controller preveously worked just fine.
With upgrade to 2.5.0 my app get's stuck in a logout-redirect-loop.
There are no overrides in the config to the signout-, etc. properties.

Reproduction steps

Use
Sign out

Ends up in loop.

Error message

No response

Id Web logs

No response

Relevant code snippets

<a class="nav-link text-dark btn btn-sm btn-outline-secondary" asp-area="MicrosoftIdentity" asp-controller="Account" asp-action="SignOut">Sign out</a>

Regression

1.26.0

Expected behavior

User get's signed out. No loop.

[michiproep]

May-be, this is related? #1558

[tasha-watson]

I'm having the same issue with the Azure B2C sample which was recently upgraded to v2.5.0. Did you find an alternative solution other than regressing the version?

[alexdulemba]

So far I've only seen that using version 1.26.0 solves the issue. Interestingly though, if you specify a custom "SignedOutCallbackPath" in appsettings.json, it will redirect from that back to Microsoft's Web.UI signed out page. Maybe this is a related issue?

[alexdulemba]

A workaround for now that seems to work: creating your own AccountController with SignIn and SignOut methods instead of using MicrosoftIdentity.AccountController SignIn and SignOut methods. Carlos Ortega's answer here provides an example. You can then set a custom URI for a signout page to be redirected to without loops. Also make sure that there is no value set in appsettings.json for the SignedOutCallbackPath key.

[jennyf19]

We've applied a workaround in 2.9.0 which should address the issue. The root cause is a breaking change in ASP.NET Core 6 with the Razor pages.