title: OpenIdConnectProtocolValidationContext.Nonce was null when using Okta in Asp.Net Web Application
body: <p>I have a .Net Asp.Net WebApplication, I am trying to use Okta for Single Sign On capabilities.  I have all my code working and running except when I use Google Chrome 80+ to sign in.  When I sign on to Okta and am called back to my application I get the following error.  Below are the steps that I have tried so far.  This works in all other browsers but is failing most likely due to Chrome 80s SameSite cookie attribute changes.</p>
  <p><strong>Server Error in '/' Application.</strong></p>
  <blockquote>
  <p>IDX21323: RequireNonce is '[PII is hidden]'.
  OpenIdConnectProtocolValidationContext.Nonce was null,
  OpenIdConnectProtocol.ValidatedIdToken.Payload.Nonce was not null. The
  nonce cannot be validated. If you don't need to check the nonce, set
  OpenIdConnectProtocolValidator.RequireNonce to 'false'. Note if a
  'nonce' is found it will be evaluated. Description: An unhandled
  exception occurred during the execution of the current web request.
  Please review the stack trace for more information about the error and
  where it originated in the code.</p>
  </blockquote>
  <p><strong>Exception Details:</strong></p>
  <blockquote>
  <p>Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolInvalidNonceException:
  IDX21323: RequireNonce is '[PII is hidden]'.
  OpenIdConnectProtocolValidationContext.Nonce was null,
  OpenIdConnectProtocol.ValidatedIdToken.Payload.Nonce was not null. The
  nonce cannot be validated. If you don't need to check the nonce, set
  OpenIdConnectProtocolValidator.RequireNonce to 'false'. Note if a
  'nonce' is found it will be evaluated.</p>
  </blockquote>
  <p><strong>Source Error:</strong></p>
  <blockquote>
  <p>An unhandled exception was generated during the execution of the
  current web request. Information regarding the origin and location of
  the exception can be identified using the exception stack trace below.</p>
  </blockquote>
  <p><strong>Stack Trace:</strong></p>
  <blockquote>
  <p>[OpenIdConnectProtocolInvalidNonceException: IDX21323: RequireNonce is
  '[PII is hidden]'. OpenIdConnectProtocolValidationContext.Nonce was
  null, OpenIdConnectProtocol.ValidatedIdToken.Payload.Nonce was not
  null. The nonce cannot be validated. If you don't need to check the
  nonce, set OpenIdConnectProtocolValidator.RequireNonce to 'false'.
  Note if a 'nonce' is found it will be evaluated.]<br />
  Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolValidator.ValidateNonce(OpenIdConnectProtocolValidationContext
  validationContext) +1374<br />
  Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolValidator.ValidateAuthenticationResponse(OpenIdConnectProtocolValidationContext
  validationContext) +219<br />
  Microsoft.Owin.Security.OpenIdConnect.d__11.MoveNext()
  +3770    System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() +27</p>
  </blockquote>
  <ol>
  <li>Upgraded .Net version to 4.7.2</li>
  <li>Upgraded Nuget packages for Microsoft.Owin to 4.1</li>
  <li>Added SameSite configs in startup</li>
  <li>Added web.config values</li>
  <li>Added CookieManager code</li>
  </ol>
  <p><code>Startup.cs</code> Configure() code</p>
  <pre><code>app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
  
  
  app.UseCookieAuthentication(new CookieAuthenticationOptions()
  {
      CookieSameSite = SameSiteMode.None,
      CookieSecure = CookieSecureOption.Always,
      CookieHttpOnly = true,
      CookieManager = new Code.SameSiteCookieManager(new Microsoft.Owin.Host.SystemWeb.SystemWebCookieManager())
  });
  
  app.UseOktaMvc(new OktaMvcOptions()
  {
      OktaDomain = ConfigurationManager.AppSettings[&quot;okta:OktaDomain&quot;],
      ClientId = ConfigurationManager.AppSettings[&quot;okta:ClientId&quot;],
      ClientSecret = ConfigurationManager.AppSettings[&quot;okta:ClientSecret&quot;],
      RedirectUri = ConfigurationManager.AppSettings[&quot;okta:RedirectUri&quot;],
      PostLogoutRedirectUri = ConfigurationManager.AppSettings[&quot;okta:PostLogoutRedirectUri&quot;],
      AuthorizationServerId = string.Empty,
      Scope = new List&lt;string&gt; { &quot;openid&quot;, &quot;profile&quot;, &quot;email&quot; },
  });
  
  Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolValidator dd = new Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolValidator();
  dd.RequireNonce = false;
  
  
  //Init ADM Kit and start logging.
  Code.KitHelper.Init();
  </code></pre>