title: ASP.NET Core 3.1 OpenIDConnect message.state is null
body: <p>So, I'm currently trying to test the oidc implicit flow of <strong>response_type=token</strong> in an OIDC client application I have spun up.</p>
  <p>I can get past the <code>/authorize</code> request to my OIDC provider. However, when the response comes back to the <code>signin-oidc</code> redirect_uri in the client I get the following error:</p>
  <pre><code>Exception: OpenIdConnectAuthenticationHandler: message.State is null or empty.
  Unknown location
  
  Exception: An error was encountered while handling the remote login.
  Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler&lt;TOptions&gt;.HandleRequestAsync()
  </code></pre>
  <p>This is what the request to my authorize endpoint looks like:</p>
  <pre><code>GET https://localhost:44303/oauth/oidctest/authorize?client_id=...
  </code></pre>
  <p><a href="https://i.stack.imgur.com/MeuP8.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/MeuP8.jpg" alt="OIDC Authorize" /></a></p>
  <p>I'm then redirected to my OIDC Provider's <code>/authorizelogin</code> endpoint to accept the application. The request looks like this:</p>
  <pre><code>POST https://localhost:44303/oauth/oidctest/authorizelogin HTTP/1.1
  </code></pre>
  <p><a href="https://i.stack.imgur.com/MPzvm.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/MPzvm.jpg" alt="authorizelogin" /></a></p>
  <p>That returns a 302 redirect URL that looks like this:</p>
  <pre><code>https://localhost:5001/signin-oidc#token_type=bearer&amp;access_token=&lt;access-token&gt;&amp;scope=openid%20profile%20address%20phone%20email&amp;expires_in=120&amp;state=CfDJ....JDER
  </code></pre>
  <p>As you can see, the state is there for EVERY request. So I'm not sure what's going on.</p>
  <p>Here is what my OIDC Middleware setup looks like in my ASP.NET Core client application's <code>Startup.cs</code>:</p>
  <pre><code>.AddOpenIdConnect(options =&gt;
              {
                  options.Authority = Configuration[&quot;auth:oidc:authority&quot;];
                  options.ClientId = Configuration[&quot;auth:oidc:clientid&quot;];
                  options.ClientSecret = Configuration[&quot;auth:oidc:clientsecret&quot;];      
                  options.ResponseType = OpenIdConnectResponseType.Token;
                  options.GetClaimsFromUserInfoEndpoint = true;
                  options.SaveTokens = true;
                  options.UseTokenLifetime = true;
                  options.Scope.Add(&quot;address&quot;);
                  options.Scope.Add(&quot;phone&quot;);
                  options.Scope.Add(&quot;email&quot;);
                  options.TokenValidationParameters = new TokenValidationParameters
                  {
                      ValidateIssuer = true,
                      ValidateAudience = true,
                      ValidateLifetime = true,
                      ValidIssuer = Configuration[&quot;auth:oidc:authority&quot;],
                      ValidAudience = Configuration[&quot;auth:oidc:clientid&quot;],
                      ValidateIssuerSigningKey = true,
                      ClockSkew = TimeSpan.FromSeconds(3)
                  };
              });
  </code></pre>
  <p>Do I need to set this state somewhere in the middleware (eventhough it looks like it sets it automatically)?</p>