Skip to content

[Bug] Don't call HandleCodeRedemption twice in TokenAcquisition.cs#L125-L128 #246

Closed
Closed
[Bug] Don't call HandleCodeRedemption twice in TokenAcquisition.cs#L125-L128#246
Assignees
jennyf19
Labels
.NET Core 5P2code cleanupfixedreported-by-aspnetcore
Milestone
[1] .NET 5 Readiness - 0.2.0-preview

Description

@jmprieur
Jean-Marc Prieur (jmprieur)
opened on Jun 24, 2020

Which Version of Microsoft Identity Web are you using ?
Microsoft Identity Web 0.1.5-preview

**Where is the issue?

*In

microsoft-identity-web/src/Microsoft.Identity.Web/TokenAcquisition.cs

Lines 125 to 128 in 0b628e2

// As AcquireTokenByAuthorizationCodeAsync is asynchronous we want to tell ASP.NET core that we are handing the code
// even if it's not done yet, so that it does not concurrently call the Token endpoint. (otherwise there will be a
// race condition ending-up in an error from Azure AD telling "code already redeemed")
context.HandleCodeRedemption();
, verify that we still need to handle the code redemption twice. This should not be needed and is the sign smell like someone is using async void.

Why is it so?
We had many cases, in the past, where the code was redeemed twice (once by Microsoft.Identity.Web and once by ASP.NET Core), which is not allowed by Azure AD.
However, async should ensure that this works fine.

What to do?
If this bugs, then the bug needs to be fixed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

.NET Core 5P2code cleanupfixedreported-by-aspnetcore

Type

No type

Projects

No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions