title: Identity server 4 post login redirect not working in chrome only
body: <p>i use identity server 4 let call it &quot;auth-server&quot; run on .net core 3.1.
  there is angular app request authentication after redirected to auth-server and provide credentials submiting the login it's not redirect back to client app.
  the issue is only in chrome browser (firefox &amp; edge works fine)
  i can see the redirect request - <a href="http://localhost:5000/connect/authorize/callback?client_id=takbull-clientapp-dev&amp;redirect_uri=http%3A%2F%2Flocalhost%3A4200%2Fauth-callback%2F&amp;response_type=id_token%20token&amp;scope=openid%20profile%20email%20takbull%20takbull.api&amp;state=d3010be061224e4c975c5109c6a3fd83&amp;nonce=28e892d37fd54beba744b777bd4cfa8f" rel="noreferrer">Request-Url</a>
  but it just go back to login page
  Client congig:</p>
  <pre><code>public static IEnumerable&lt;Client&gt; GetClients()
  {
      return new List&lt;Client&gt;(){
              new Client() {
                               RequireConsent =false,
                               RequireClientSecret = false,
                               ClientId = &quot;takbull-clientapp-dev&quot;,
                               ClientName = &quot;Takbull Client&quot;,
                               AllowedGrantTypes = GrantTypes.ImplicitAndClientCredentials,
                               AllowedScopes = new List&lt;string&gt; 
                               {
                                IdentityServerConstants.StandardScopes.OpenId,
                                IdentityServerConstants.StandardScopes.Email,
                                IdentityServerConstants.StandardScopes.Profile,
                                &quot;takbull&quot;,
                                &quot;takbull.api&quot; 
                               },
                               // where to redirect to after login
                               RedirectUris = new List&lt;string&gt;()
                               {
                                   &quot;http://localhost:4200/auth-callback/&quot;,
                                   &quot;http://localhost:4200/silent-refresh.html&quot;,
                               },
                               //TODO: Add Production URL
                               // where to redirect to after logout
                               PostLogoutRedirectUris =new List&lt;string&gt;() 
                               {
                                   &quot;http://localhost:4200&quot;
                               },
                               AllowedCorsOrigins = {&quot;http://localhost:4200&quot;},
                               AllowAccessTokensViaBrowser = true,
                               AccessTokenLifetime = 3600,
                               AlwaysIncludeUserClaimsInIdToken = true
                           },
          };
      }
  </code></pre>
  <p>Login Code:</p>
  <pre><code>[HttpPost]
  [ValidateAntiForgeryToken]
  public async Task&lt;IActionResult&gt; Login(LoginInputModel model, string button)
  {
      // check if we are in the context of an authorization request
      var context = await _interaction.GetAuthorizationContextAsync(model.ReturnUrl);
  
      // the user clicked the &quot;cancel&quot; button
      if (button != &quot;login&quot;)
      {
          if (context != null)
          {
              // if the user cancels, send a result back into IdentityServer as if they 
              // denied the consent (even if this client does not require consent).
              // this will send back an access denied OIDC error response to the client.
              await _interaction.GrantConsentAsync(context, ConsentResponse.Denied);
  
              // we can trust model.ReturnUrl since GetAuthorizationContextAsync returned non-null
              if (await _clientStore.IsPkceClientAsync(context.ClientId))
              {
                  // if the client is PKCE then we assume it's native, so this change in how to
                  // return the response is for better UX for the end user.
                  return View(&quot;Redirect&quot;, new RedirectViewModel { RedirectUrl = model.ReturnUrl });
               }
  
               return Redirect(model.ReturnUrl);
           }
           else
           {
              // since we don't have a valid context, then we just go back to the home page
              return Redirect(&quot;~/&quot;);
           }
       }
  
       if (ModelState.IsValid)
       {
           // validate username/password against in-memory store
           var ValidResp = await _users.ValidateCredentials(model.Username, model.Password);
           if (ValidResp.LogInStatus == LogInStatus.Success)
           {
               var user = _users.FindByUsername(model.Username);
               //await _events.RaiseAsync(new UserLoginSuccessEvent(user.Username, user.SubjectId, user.Username));
               await _events.RaiseAsync(new UserLoginSuccessEvent(user.Email, user.UserId.ToString(), user.Email));
  
               // only set explicit expiration here if user chooses &quot;remember me&quot;. 
               // otherwise we rely upon expiration configured in cookie middleware.
               AuthenticationProperties props = null;
               if (AccountOptions.AllowRememberLogin &amp;&amp; model.RememberLogin)
               {
                   props = new AuthenticationProperties
                   {
                      IsPersistent = true,
                      ExpiresUtc = DateTimeOffset.Now.Add(AccountOptions.RememberMeLoginDuration)
                   };
               };
  
               // issue authentication cookie with subject ID and username
               //await HttpContext.SignInAsync(user.SubjectId, user.Username, props);
               // issue authentication cookie with subject ID and username
               await HttpContext.SignInAsync(user.UserId.ToString(), user.FirstName + &quot; &quot; + user.LastName, props, _users.GetClaims(user).ToArray());
  
               if (context != null)
               {
                   if (await _clientStore.IsPkceClientAsync(context.ClientId))
                   {
                       // if the client is PKCE then we assume it's native, so this change in how to
                       // return the response is for better UX for the end user.
                       return View(&quot;Redirect&quot;, new RedirectViewModel { RedirectUrl = model.ReturnUrl });
                   }
  
                   // we can trust model.ReturnUrl since GetAuthorizationContextAsync returned non-null
                   return Redirect(model.ReturnUrl);
               }
  
               // request for a local page
               if (Url.IsLocalUrl(model.ReturnUrl))
               {
                   return Redirect(model.ReturnUrl);
               }
               else if (string.IsNullOrEmpty(model.ReturnUrl))
               {
                   return Redirect(&quot;~/&quot;);
               }
               else
               {
                   // user might have clicked on a malicious link - should be logged
                   throw new Exception(&quot;invalid return URL&quot;);
               }
           }
  
           await _events.RaiseAsync(new UserLoginFailureEvent(model.Username, ValidResp.ResponseDescription));
           ModelState.AddModelError(string.Empty, ValidResp.ResponseDescription);
       }
  
       // something went wrong, show form with error
       var vm = await BuildLoginViewModelAsync(model);
       return View(vm);
  }
  </code></pre>