title: Infinite authentication loop when using identityserver4 in asp.net core 2.0
body: <p>I have an Identity Server using identityserver4 framework, its url is <a href="http://localhost:9000" rel="noreferrer">http://localhost:9000</a></p>
  
  <p>My web application is asp.net core 2.0, its url is <a href="http://localhost:60002" rel="noreferrer">http://localhost:60002</a>. This application will use the login page of Identity Server. </p>
  
  <p>I want after logging in, the Identity Server will redirect to the application page (<a href="http://localhost:60002" rel="noreferrer">http://localhost:60002</a>)</p>
  
  <p><strong>Here is the Startup.cs of client application</strong></p>
  
  <p>Startup.cs
  <div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>public class Startup
      {
          public Startup(IConfiguration configuration)
          {
              Configuration = configuration;
          }
  
          public IConfiguration Configuration { get; }
  
          private string AuthorityUri =&gt; Configuration.GetValue&lt;string&gt;("UserManagement-Authority");
  
          // This method gets called by the runtime. Use this method to add services to the container.
          public void ConfigureServices(IServiceCollection services)
          {
              JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();            
  
              services.AddAuthentication(options =&gt;
              {
                  options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                  options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
              })
              .AddCookie()
              .AddOpenIdConnect(options =&gt;
              {
                  options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                  options.Authority = AuthorityUri; // "http://localhost:9000"
                  options.RequireHttpsMetadata = false;
                  options.ClientId = "customer.api";
                  options.ClientSecret = "testsecret";
                  options.ResponseType = "code id_token";
                  options.Scope.Add("customerprivatelinesvn.api");
                  options.Scope.Add("offline_access");
                  options.GetClaimsFromUserInfoEndpoint = true;
                  options.SaveTokens = true;
              });
  
              services.AddMvc();
          }
  
          // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
          public void Configure(IApplicationBuilder app, IHostingEnvironment env)
          {
              if (env.IsDevelopment())
              {
                  app.UseDeveloperExceptionPage();
                  app.UseWebpackDevMiddleware(new WebpackDevMiddlewareOptions
                  {
                      HotModuleReplacement = true
                  });
              }
              else
              {
                  app.UseExceptionHandler("/Home/Error");
              }
  
              app.UseStaticFiles();            
  
              app.UseMvc(routes =&gt;
              {
                  routes.MapRoute(
                      name: "default",
                      template: "{controller=Home}/{action=Index}/{id?}");
  
                  routes.MapSpaFallbackRoute(
                      name: "spa-fallback",
                      defaults: new { controller = "Home", action = "Index" });
              });
          }
      }</code></pre>
  </div>
  </div>
  </p>
  
  <p><strong>Here is the loggin page on Identity Server</strong></p>
  
  <p><a href="https://i.stack.imgur.com/JYxuk.png" rel="noreferrer"><img src="https://i.stack.imgur.com/JYxuk.png" alt="enter image description here"></a></p>
  
  <p><strong>But there is an infinite loop that calls to <a href="http://localhost:9000/connect/authorize" rel="noreferrer">http://localhost:9000/connect/authorize</a> endpoint, and then it returns to <a href="http://localhost:60002/signin-oidc" rel="noreferrer">http://localhost:60002/signin-oidc</a> with "Bad Request - Request Too Long" as below.</strong></p>
  
  <p><strong>When I look at the cookies, there ar lots of items ".AspNetCore.Correlation.OpenIdConnect.xxx"</strong>
  <a href="https://i.stack.imgur.com/If7Qv.png" rel="noreferrer"><img src="https://i.stack.imgur.com/If7Qv.png" alt="enter image description here"></a></p>
  
  <p><strong>Here is the log on Identiy Server. It said that Identiy.Application was successfully authenticated.</strong>
  <a href="https://i.stack.imgur.com/KiUZS.png" rel="noreferrer"><img src="https://i.stack.imgur.com/KiUZS.png" alt="enter image description here"></a></p>
  
  <p>Does anyone know what this problem is? And how to resolve this? Thank you very much.</p>
  
  <p>Best regards,</p>
  
  <p>Kevin</p>