Blazor webassembly successful authentication causes browser crash in VS 16.7.2 (when saving password)

[gerritjs]

Describe the bug

After a successful external authentication (External IdentityServer 4) the browser and debugger crash with no additional information. This happens only the second and consecutive successful authentications (when saving the password). The authentication in the first debug session works ok. Using another browser will also only work once (again when saving the password).

(having FireFox to remove cookies and webinfo after closure can be used as a workaround. This works in combination with saving the password)

To Reproduce

Jusing an existing IdentityServer 4 implementation

Create a new project using:
dotnet new blazorwasm -au individual -n BlazorClient

Change the existing oidc configuration in program.cs to:

        builder.Services.AddOidcAuthentication(options =>
        {
            builder.Configuration.Bind("oidc", options.ProviderOptions);
        });

and using the following configuration:

{
"oidc": {
"Authority": "https://localhost:8750/",
"ClientId": "BlazorClient",
"DefaultScopes": [
"openid",
"profile",
"email"
],
"PostLogoutRedirectUri": "/",
"ResponseType": "code"
}
}

Exceptions (if any)

No exception information available

Further technical details

• Visual Studio 16.7.2
  .NET Core SDK (reflecting any global.json):
  Version: 3.1.401
  Commit: 5b6f5e5005

Runtime Environment:
OS Name: Windows
OS Version: 10.0.18362
OS Platform: Windows
RID: win10-x64
Base Path: C:\Program Files\dotnet\sdk\3.1.401\

Host (useful for support):
Version: 3.1.7
Commit: fcfdef8d6b

.NET Core SDKs installed:
2.1.801 [C:\Program Files\dotnet\sdk]
2.2.401 [C:\Program Files\dotnet\sdk]
3.0.100 [C:\Program Files\dotnet\sdk]
3.1.100 [C:\Program Files\dotnet\sdk]
3.1.200 [C:\Program Files\dotnet\sdk]
3.1.201 [C:\Program Files\dotnet\sdk]
3.1.301 [C:\Program Files\dotnet\sdk]
3.1.401 [C:\Program Files\dotnet\sdk]

.NET Core runtimes installed:
Microsoft.AspNetCore.All 2.1.12 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
Microsoft.AspNetCore.All 2.1.21 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
Microsoft.AspNetCore.All 2.2.6 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
Microsoft.AspNetCore.App 2.1.12 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 2.1.21 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 2.2.6 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 3.0.0 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 3.1.7 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App 2.1.12 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 2.1.21 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 2.2.6 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 3.0.0 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 3.1.7 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 3.0.0 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 3.1.7 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

[mkArtakMSFT]

Thanks for contacting us.
Can you please clarify what you mean by "crash" here? Does the browser gets closed and the debugging stops?

[gerritjs]

Thats correct. The browser closes and the debugger stops without any further information.

[philipri]

I have a similar repo with a fresh Blazor WebAssembly app (and my own 'full' app). There also seems to be a relationship between credentials pre-filled by the browser (but the repro is consistent).

See this: https://stackoverflow.com/questions/63651738/blazor-webassembly-hosted-proxy-crash-on-successful-authentication

My suspicion is that something in the AuthenticationService.js is causing some issue which causing the debugger proxy to terminate.1

Here is the tail of my vscode-edge-debug.txt if that's useful./

{"tag":"cdp.receive","timestamp":1599446115897,"metadata":{"connectionId":0,"message":{"method":"Network.responseReceived","params":{"requestId":"27108.66","loaderId":"435E04D101F180BE296A89743C45D909","timestamp":58722.712101,"type":"Script","response":{"url":"https://localhost:5008/_framework/blazor.webassembly.js","status":200,"statusText":"","headers":{"date":"Mon, 07 Sep 2020 02:35:15 GMT","content-encoding":"gzip","last-modified":"Mon, 07 Sep 2020 02:03:59 GMT","server":"Kestrel","etag":""1d684bb2647eafc"","blazor-environment":"Development","vary":"Content-Encoding","content-type":"application/javascript","status":"304","cache-control":"no-cache","accept-ranges":"bytes","content-length":"15228"},"mimeType":"application/javascript","connectionReused":true,"connectionId":45,"remoteIPAddress":"[::1]","remotePort":5008,"fromDiskCache":false,"fromServiceWorker":false,"fromPrefetchCache":false,"encodedDataLength":291,"timing":{"requestTime":58722.675756,"proxyStart":-1,"proxyEnd":-1,"dnsStart":-1,"dnsEnd":-1,"connectStart":-1,"connectEnd":-1,"sslStart":-1,"sslEnd":-1,"workerStart":-1,"workerReady":-1,"workerFetchStart":-1,"workerRespondWithSettled":-1,"sendStart":4.371,"sendEnd":4.925,"pushStart":0,"pushEnd":0,"receiveHeadersEnd":25.522},"responseTime":1599446115883.991,"protocol":"h2","securityState":"secure","securityDetails":{"protocol":"TLS 1.2","keyExchange":"ECDHE_RSA","keyExchangeGroup":"P-384","cipher":"AES_256_GCM","certificateId":0,"subjectName":"localhost","sanList":["localhost"],"issuer":"localhost","validFrom":1587949657,"validTo":1619485657,"signedCertificateTimestampList":[],"certificateTransparencyCompliance":"not-compliant"}},"frameId":"1A8A21D9B19C9E02F9CD09F90A357C53"},"sessionId":"741A3041A324A3B7B24825C632F85768"}},"level":0}
{"tag":"cdp.receive","timestamp":1599446115897,"metadata":{"connectionId":0,"message":{"method":"Network.dataReceived","params":{"requestId":"27108.66","timestamp":58722.712192,"dataLength":60469,"encodedDataLength":0},"sessionId":"741A3041A324A3B7B24825C632F85768"}},"level":0}
{"tag":"runtime.sourcecreate","timestamp":1599446115897,"message":"Creating source from url","metadata":{"inputUrl":"https://localhost:5008/_content/Microsoft.AspNetCore.Components.WebAssembly.Authentication/AuthenticationService.js","absolutePath":"C:\\Users\\philip\\.nuget\\packages\\microsoft.aspnetcore.components.webassembly.authentication\\3.2.1\\staticwebassets\\AuthenticationService.js"},"level":0}
{"tag":"cdp.receive","timestamp":1599446115900,"metadata":{"connectionId":0,"message":{"method":"Network.loadingFinished","params":{"requestId":"27108.66","timestamp":58722.701968,"encodedDataLength":291,"shouldReportCorbBlocking":false},"sessionId":"741A3041A324A3B7B24825C632F85768"}},"level":0}
{"tag":"dap.send","timestamp":1599446115904,"metadata":{"connectionId":0,"message":{"seq":153,"type":"event","event":"loadedSource","body":{"reason":"new","source":{"name":"localhost꞉5008/_content/Microsoft.AspNetCore.Components.WebAssembly.Authentication/AuthenticationService.js","path":"C:\Users\philip\.nuget\packages\microsoft.aspnetcore.components.webassembly.authentication\3.2.1\staticwebassets\AuthenticationService.js","sourceReference":0}},"sessionId":"741A3041A324A3B7B24825C632F85768"}},"level":0}
{"tag":"dap.send","timestamp":1599446116625,"metadata":{"connectionId":0,"message":{"seq":16,"type":"event","event":"terminated","body":{}}},"level":0}
{"tag":"dap.receive","timestamp":1599446116632,"metadata":{"connectionId":0,"message":{"type":"request","command":"disconnect","arguments":{},"seq":5}},"level":0}
{"tag":"dap.send","timestamp":1599446116635,"metadata":{"connectionId":0,"message":{"seq":17,"type":"response","request_seq":5,"command":"disconnect","success":true,"body":{}}},"level":0}
{"tag":"dap.receive","timestamp":1599446116668,"metadata":{"connectionId":0,"message":{"type":"request","command":"disconnect","arguments":{"terminateDebuggee":false},"seq":5,"sessionId":"741A3041A324A3B7B24825C632F85768"}},"level":0}
{"tag":"dap.send","timestamp":1599446116668,"metadata":{"connectionId":0,"message":{"seq":154,"type":"event","event":"output","body":{"category":"telemetry","output":"js-debug/breakpointStats","data":{"set":0,"verified":0,"hit":0}},"sessionId":"741A3041A324A3B7B24825C632F85768"}},"level":0}
{"tag":"dap.send","timestamp":1599446116669,"metadata":{"connectionId":0,"message":{"seq":155,"type":"event","event":"thread","body":{"reason":"exited","threadId":0},"sessionId":"741A3041A324A3B7B24825C632F85768"}},"level":0}
{"tag":"dap.send","timestamp":1599446116669,"metadata":{"connectionId":0,"message":{"seq":156,"type":"event","event":"terminated","body":{},"sessionId":"741A3041A324A3B7B24825C632F85768"}},"level":0}
{"tag":"dap.send","timestamp":1599446116669,"metadata":{"connectionId":0,"message":{"seq":157,"type":"response","request_seq":5,"command":"disconnect","success":true,"body":{},"sessionId":"741A3041A324A3B7B24825C632F85768"}},"level":0}

[philipri]

Update to my repro.

If I disable address saving (i.e. email address / login) and password saving on Edge and manually type in the user/password then there is no 'crash' of Edge.

This is obviously a bizarre bug.

Tagging subscribers to this area: @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

[mkArtakMSFT]

@lewing FYI

[richardhauer]

We have the same issue, but with Azure AD B2C.

We have tried to hijack the /authentication/login-callback system, assuming the issue was something to do with the processing of the response, but that did not help.

We have seen the issue running under both IISExpress and Kestrel, but the issue seems to be easier to reproduce when running in Kestrel. As with other comments, the issue is easier to reproduce when using credentials stored in the browser, rather than manually typing them in, however we have seen the issue also with manual credentials as well.

There's no error messages we can capture, the debugger detaches and the browser closes -

mono_wasm_runtime_ready fe00e07a-5519-4dfe-b35a-f867dbaf2e28
The program '' has exited with code -1 (0xffffffff).
The program '[18616] dotnet.exe: Program Trace' has exited with code 0 (0x0).
The thread 0x0 has exited with code 0 (0x0).
The program 'localhost:5001' has exited with code -1 (0xffffffff).
The program '[18616] dotnet.exe' has exited with code -1 (0xffffffff).

FWIW We have also tried the same in VS 16.7.2 and 16.8.0 Preview 3 with the same result

[patrickwensel]

Same issue on 2 web assembly projects, i have to clear the saved login/password and type them in each time

[TheAnachronism]

I had the same issue on my web assembly project. The browser just instantly closes without further warning or errors. Took quite some time to find out which behavior was causing this.

[lewing]

If the browser is crashing edge/chromium should generate a crash dump under C:\Users\<user>\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports (see https://www.chromium.org/developers/crash-reports)

This crash sounds like it is more related to credential saving than wasm but it difficult to know without more details.

[lewing]

cc @kg

[kg]

Which browser(s) are behaving this way? Firefox? Chrome? Edge? Does it close if there are other tabs open?

[patrickwensel]

Chrome and Edge

…

________________________________ From: Katelyn Gadd <notifications@github.com> Sent: Tuesday, September 15, 2020 9:44:25 PM To: dotnet/runtime <runtime@noreply.github.com> Cc: patrickwensel <pwensel@hotmail.com>; Comment <comment@noreply.github.com> Subject: Re: [dotnet/runtime] Blazor webassembly successful authentication causes browser crash in VS 16.7.2 (when saving password) (#41969) Which browser(s) are behaving this way? Firefox? Chrome? Edge? Does it close if there are other tabs open? — You are receiving this because you commented. Reply to this email directly, view it on GitHub<https://github.com/dotnet/runtime/issues/41969#issuecomment-692902992>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AA332MQUS2MINSBN2ILNA6DSF6YYTANCNFSM4RAHKPYQ>.

[kg]

Unfortunately, I followed the reproduction steps and could not get any authentication prompt to appear to reproduce the issue.

Despite changing Program.cs to use oidc as suggested in the report + updating the wwwroot/appsettings.json and wwwroot/appsettings.Development.json, I only get this message:

It seems as if I need to do something else to enable oidc.