<p>I have a dotnet core mvc web application using AzureAD b2c authentication (via OpenId Connect). This works correctly when I run it against localhost but when I deploy the solution to Kubernetes and I try to login I get the following error:</p>

<pre><code>Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware[1]
      An unhandled exception has occurred while executing the request.
System.Exception: An error was encountered while handling the remote login.
 ---&gt; System.Exception: Unable to unprotect the message.State.
   --- End of inner exception stack trace ---
   at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler`1.HandleRequestAsync()
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware.&lt;Invoke&gt;g__Awaited|6_0(ExceptionHandlerMiddleware middleware, HttpContext context, Task task)'
</code></pre>

<p>I have set up an NGINX ingress with SSL that forwards the traffic to the service in Kubernetes so this is acting as a reverse proxy within the cluster. </p>

<p>To ensure that the request's original hostname is retained I have added the following to the startup.cs:</p>

<pre><code>services.Configure&lt;ForwardedHeadersOptions&gt;(options =&gt;
            {
                options.ForwardedHeaders =
                    ForwardedHeaders.XForwardedProto | ForwardedHeaders.XForwardedHost;
                options.KnownNetworks.Clear();
                options.KnownProxies.Clear();
            });
</code></pre>

<pre><code>app.UseForwardedHeaders();
</code></pre>

<p>As well as adding the following annotations to my Ingress </p>

<pre><code>    nginx.ingress.kubernetes.io/proxy_http_version: "1.1"
    nginx.ingress.kubernetes.io/proxy_set_header: "Upgrade $http_upgrade"
    nginx.ingress.kubernetes.io/proxy_set_header: "Connection keep-alive"
    nginx.ingress.kubernetes.io/proxy_set_header: "Host $host"
    nginx.ingress.kubernetes.io/proxy_cache_bypass: "$http_upgrade"
    nginx.ingress.kubernetes.io/proxy_set_header: "X-Forwarded-For $proxy_add_x_forwarded_for"
    nginx.ingress.kubernetes.io/proxy_set_header: "X-Forwarded-Proto $scheme"
    nginx.ingress.kubernetes.io/proxy_buffers: "16 16k"
    nginx.ingress.kubernetes.io/proxy_buffer_size: "32k"
</code></pre>

<p>I've also made sure that the reply URLs have been correctly configured in Azure.</p>

<p>Is there a step I am missing when configuring the Ingress (NGINX) that could cause this issue?</p>

<p>I had the same problem, adding data protection fixed it:</p>
<pre class="lang-cs prettyprint-override"><code>        private void AddDataProtection(IServiceCollection services, IConfiguration configuration)
        {
            var serviceProvider = services.BuildServiceProvider();
            var kvClient = serviceProvider.GetRequiredService&lt;IKeyVaultClient&gt;();
            var vaultSettings = configuration.GetConfiguredSettings&lt;VaultSettings&gt;();
            var redisSettings = configuration.GetConfiguredSettings&lt;RedisSettings&gt;();
            var redisAccessKey = kvClient.GetSecretAsync(vaultSettings.VaultUrl, redisSettings.AccessKeySecretName).GetAwaiter().GetResult().Value;
            var connectionMultiplexer = ConnectionMultiplexer.Connect(new ConfigurationOptions()
            {
                EndPoints = { redisSettings.Endpoint },
                Password = redisAccessKey,
                Ssl = true,
                AbortOnConnectFail = false
            });
            var key = $&quot;{env.ApplicationName}::{env.EnvironmentName}::DataProtection::Keys&quot;;
            Logger.LogInformation($&quot;protect data using key={key}, cert='{redisSettings.ProtectionCertSecretName}'&quot;);
            var x509 = kvClient.GetX509CertificateAsync(vaultSettings.VaultUrl, redisSettings.ProtectionCertSecretName)
                .GetAwaiter().GetResult();
            services.AddDataProtection()
                .PersistKeysToRedis(connectionMultiplexer, key)
                .ProtectKeysWithCertificate(x509);
        }
</code></pre>
