Azure Adb2c External IDP Authentication Browser Back Button Click redirects to External IDP Again

Question

We have AD B2C Authentication with .NET 8 MVC Web Application. We configured Open Id Provider with Custom Policy in Adb2c. The authentication is working successfully. But the problem is, after the External IDP successful authentication, the provider redirects to the web site. Now User clicks on browser back button, the site redirect to external idp, because the history is there in the window (single and multiple click applicable). On multiple click adb2c shows bad request, because session is already exist in the browser window.

Info: we disabled the External IDP SSO login for force login every time, since adb2c manages the users session.

Web site => Adb2c + External IDP => Successful Authentication => Redirects to Web Site => Web Site => Browser Back Button (Single Or Multiple click) <= External Idp or Adb2c Bad Request.

Is there any way to restrict the redirection to external idp or adb2c bad request, I tried the browser back button click disable, that didn't help.

is there any way to handle this adb2c bad request in asp.net core mvc.

Answer 1

Hi @Logesh Palani , sorry for the delay in response. Please try the following and let me know if they work for you.

When the user clicks on the browser back button, the site redirects to the external IDP again. This happens because the history is still present in the window.

To restrict the redirection to the external IDP or ADB2C bad request, you can try using the sessionStorage object. You can store a flag in the sessionStorage object when the user is authenticated successfully and check for the flag when the user clicks on the back button. If the flag is present, you can redirect the user to the home page instead of the external IDP.

Here is an example of how you can use the sessionStorage object:

// Set the flag in sessionStorage when the user is authenticated successfully
sessionStorage.setItem('authenticated', 'true');

// Check for the flag when the user clicks on the back button
window.addEventListener('popstate', function(event) {
  if (sessionStorage.getItem('authenticated') === 'true') {
    sessionStorage.removeItem('authenticated');
    window.location.href = '/';
  }
});

To handle bad request you can catch the OpenIdConnectProtocolException exception and redirect the user to an error page.:

app.UseExceptionHandler(errorApp =>
{
    errorApp.Run(async context =>
    {
        var exception = context.Features.Get<IExceptionHandlerFeature>().Error;
        if (exception is OpenIdConnectProtocolException)
        {
            context.Response.Redirect("/Error");
        }
    });
});

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James