Cancelled Login creates 500 response in signin-battlenet

[thewyzard44]

Cancelled Login creates 500 response in signin-battlenet

[kevinchalet]

Or is it an issue with the base OAuth Provider? (quickly! RC2 is imminent ;)

Yep, though it's actually by-design: RemoteAuthenticationHandler and OAuthHandler (the classes that handle the callback path dance) don't consider access_denied as a special error and simply return a 500 response to indicate that the external authentication process failed.

In RC2, the handler no longer returns a 500 response but directly throws an exception. If the exception is not caught by one of the middleware registered before the social provider, the server is responsible of intercepting it and returning a 500 response.

To stop using the default logic (which is... well; not super user-friendly 😄), the recommended approach is to use the RemoteError event to redirect the user agent to an error page.

app.UseBattleNetAuthentication(options => {
    options.SaveTokensAsClaims = true;
    options.Scope.Add("wow.profile");
    options.ClientSecret = Configuration["xxxxxxxxx:BattleNet:Secret"];
    options.ClientId = Configuration["xxxxxxxxx:BattleNet:Key"];
    options.Events = new OAuthEvents {
        OnRemoteError = context => {
            context.Response.Redirect("/oauth-error-page");
            context.HandleResponse();

            return Task.FromResult(0);
        }
    };
});

That said, I agree the default experience sucks. I'm pretty sure we had plans to introduce an AccessDeniedPath property, but I can't find the corresponding work item.

I'll move your ticket to the aspnet/Security repository.

[kevinchalet]

Moved to aspnet/Security#710.