{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1346","repository_url":"https://api.github.com/repos/IdentityServer/IdentityServer3","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1346/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1346/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1346/events","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1346","id":75301076,"number":1346,"title":"Proper handling of the [OpenIdConnectProtocolInvalidNonceException: IDX10316]","user":{"login":"balbelias","id":3427274,"avatar_url":"https://avatars.githubusercontent.com/u/3427274?v=3","gravatar_id":"","url":"https://api.github.com/users/balbelias","html_url":"https://github.com/balbelias","followers_url":"https://api.github.com/users/balbelias/followers","following_url":"https://api.github.com/users/balbelias/following{/other_user}","gists_url":"https://api.github.com/users/balbelias/gists{/gist_id}","starred_url":"https://api.github.com/users/balbelias/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/balbelias/subscriptions","organizations_url":"https://api.github.com/users/balbelias/orgs","repos_url":"https://api.github.com/users/balbelias/repos","events_url":"https://api.github.com/users/balbelias/events{/privacy}","received_events_url":"https://api.github.com/users/balbelias/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/labels/invalid","name":"invalid","color":"e6e6e6"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2015-05-11T17:39:10Z","updated_at":"2016-07-25T11:01:29Z","closed_at":"2015-05-22T05:39:45Z","body":"I wonder how to properly handle mentioned exception. It's caused by expired nonce. At present time all pages on my site are only for authenticated users, so when user open site he will be instantly redirected to idsrv. And sometimes he stays on login page for more than hour (default lifetime for nonce). And the exception with not user friendly page shows. The only way for user is to close tab and open again, page refresh would not help.\r\n\r\nFor now I just set nonce lifetime to 24 hours but I wonder if there is a better solution.\r\n\r\nI have also tried catch it in OpenIdConnectAuthenticationNotifications.AuthenticationFailed handler and redirect user to error page. But there the next trouble appears. Inspite of fact that mentioned handler executes, the user seems to be logged in.\r\n\r\nI'm attaching fiddler trace for described behaviour, if you need it.\r\nhttps://www.dropbox.com/s/lf7mkgz56rp2kso/trace.saz?dl=0\r\n\r\nThanks in advance."},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/comments/234923914","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1346#issuecomment-234923914","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1346","id":234923914,"user":{"login":"tony-mowers","id":3998443,"avatar_url":"https://avatars.githubusercontent.com/u/3998443?v=3","gravatar_id":"","url":"https://api.github.com/users/tony-mowers","html_url":"https://github.com/tony-mowers","followers_url":"https://api.github.com/users/tony-mowers/followers","following_url":"https://api.github.com/users/tony-mowers/following{/other_user}","gists_url":"https://api.github.com/users/tony-mowers/gists{/gist_id}","starred_url":"https://api.github.com/users/tony-mowers/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tony-mowers/subscriptions","organizations_url":"https://api.github.com/users/tony-mowers/orgs","repos_url":"https://api.github.com/users/tony-mowers/repos","events_url":"https://api.github.com/users/tony-mowers/events{/privacy}","received_events_url":"https://api.github.com/users/tony-mowers/received_events","type":"User","site_admin":false},"created_at":"2016-07-25T11:01:28Z","updated_at":"2016-07-25T11:01:28Z","body":"@danutzplusplus Could you share your AuthenticationFailed notification handler.  I'm not sure how to suppress the exception in the handler.  \r\n\r\nI am using jirikavi's Application_Error solution, but I'd like to understand how to accomplish something similar in the AuthenticationFailed handler."}}
{"actor":{"display_login":"tony-mowers"}}