{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2420","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2420/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2420/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2420/events","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/2420","id":126779143,"number":2420,"title":"SignInMessage Cookie is empty","user":{"login":"ScottDLance","id":2387086,"avatar_url":"https://avatars.githubusercontent.com/u/2387086?v=3","gravatar_id":"","url":"https://api.github.com/users/ScottDLance","html_url":"https://github.com/ScottDLance","followers_url":"https://api.github.com/users/ScottDLance/followers","following_url":"https://api.github.com/users/ScottDLance/following{/other_user}","gists_url":"https://api.github.com/users/ScottDLance/gists{/gist_id}","starred_url":"https://api.github.com/users/ScottDLance/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ScottDLance/subscriptions","organizations_url":"https://api.github.com/users/ScottDLance/orgs","repos_url":"https://api.github.com/users/ScottDLance/repos","events_url":"https://api.github.com/users/ScottDLance/events{/privacy}","received_events_url":"https://api.github.com/users/ScottDLance/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/labels/investigating","name":"investigating","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2016-01-15T00:17:44Z","updated_at":"2016-01-20T01:15:43Z","closed_at":null,"body":"There seems to be an issue where in a browser session that has been open a long time, that Identity Server will create a SignInMessage cookie with the value of a single period.\r\n\r\nIn our particular case is seems that when a browser is open for a long time (e.g. > 8 hours) that when a request to the Login page will produce the empty SignInMessage cookie, thereby causing Base64Url.cs in IdentityModel to throw a Illegal base64url string! exception.\r\n\r\nBelow are the cookies created for a request in a browser that has been open 24 hours:\r\n\r\n![image](https://cloud.githubusercontent.com/assets/2387086/12341819/9a5718e0-bae1-11e5-8dcb-61d4f630d9f6.png)\r\n\r\nIn my research the SignInMessage cookie is a result of some of the parameters in the request (e.g. ClientId, RedirectUri), for some reason even though in the request we see all the parameters being sent through in the querystring, they are for some reason, not being read and created as part of the SignInMessage.  \r\n\r\nHere is a sample of the request:\r\n\r\nhttps://my.identityserver.com/core/connect/authorize?\r\nclient_id=clientid\r\n&redirect_uri=https%3a%2f%2fredirecturi.com\r\n&response_mode=form_post\r\n&response_type=id_token+token\r\n&scope=openid\r\n&state=OpenIdConnect.AuthenticationProperties%3dVTbCRzE0yH9D6baYW9uTh_iRfuTYtR0v_Osrp-dbErQC7lB4ZPf2Mb92z9doFovcthAgBzHMpKJDNZ0Pc5ITII0PCfDGpuxCQmspJgYUKRvcEPfQWNhH-eYQ6JyWMGeqixQfMCzHdbk_Om1OoowkG7qICxOXh5xMGFdlTrZApcnR2rCOQW-IcvT0l4Dcv2exEZPA2g&nonce=635884265938756288.YTE1Zjc5NDMtYjE2Ni00NmMzLWEwMGQtYzMwYWNhNzlhMzhjOTViN2RkNDMtYjE5YS00N2RlLTg2ZmItNTkzM2YxMDVkZWY4\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/comments/173043933","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/2420#issuecomment-173043933","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2420","id":173043933,"user":{"login":"ScottDLance","id":2387086,"avatar_url":"https://avatars.githubusercontent.com/u/2387086?v=3","gravatar_id":"","url":"https://api.github.com/users/ScottDLance","html_url":"https://github.com/ScottDLance","followers_url":"https://api.github.com/users/ScottDLance/followers","following_url":"https://api.github.com/users/ScottDLance/following{/other_user}","gists_url":"https://api.github.com/users/ScottDLance/gists{/gist_id}","starred_url":"https://api.github.com/users/ScottDLance/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ScottDLance/subscriptions","organizations_url":"https://api.github.com/users/ScottDLance/orgs","repos_url":"https://api.github.com/users/ScottDLance/repos","events_url":"https://api.github.com/users/ScottDLance/events{/privacy}","received_events_url":"https://api.github.com/users/ScottDLance/received_events","type":"User","site_admin":false},"created_at":"2016-01-20T01:15:43Z","updated_at":"2016-01-20T01:15:43Z","body":"So I checked the clock on the server and the client and they are both correct.  I don't believe there is a proxy.\r\n\r\nHere is an HTTP trace where it failed:\r\n\r\n![fiddlertrace](https://cloud.githubusercontent.com/assets/2387086/12437154/955694ce-bed8-11e5-8bbc-3f87bc94c7f0.png)\r\n\r\nCookies on that request:\r\n\r\n![cookies](https://cloud.githubusercontent.com/assets/2387086/12437157/9b896c36-bed8-11e5-98de-6c56f3d14d9c.png)\r\n\r\n"}}