Azure AD B2C

Question

I have implemented the Azure AD B2c in my .net core MVC Application. Where after logged in to my application if i click the browser back button, it redirects to an error page

Abhishek Yadav · Answer

To resolve this issue, you can follow these steps: Disable caching for the pages that require authentication: Add the [NoCache] attribute to the action methods of your controllers. Implement the [NoCache] attribute using a custom filter attribute or the response headers. Example: [NoCache] public IActionResult SecurePage() { // Your secure page logic } Configure the Startup.cs file to add the necessary headers: In the ConfigureServices method, add the following code: services.AddMvc(options => { var policy = new CacheProfile(); policy.NoStore = true; options.Filters.Add(new AuthorizeFilter(policy)); }); In the Configure method, add the following code: app.Use(async (context, next) => { context.Response.Headers["Cache-Control"] = "no-cache, no-store, must-revalidate"; context.Response.Headers["Pragma"] = "no-cache"; context.Response.Headers["Expires"] = "0"; await next(); }); Set the Redirect URLs properly in the Azure AD B2C settings: Make sure the Redirect URLs in the Azure AD B2C settings are correct. They should match the URLs defined in your application's code. By following these steps, you should be able to prevent the redirect to the error page when clicking the browser back button after logging in.

Cr Bhargavi · Answer

Please ensure that you have appropriate cache control headers set in your application's responses, especially on the pages involved in the authentication process and please make sure you're handling token expiration properly in your application. You might need to refresh the token or re-authenticate if it has expired.

Mohammad Hussain · Answer

Experiencing issues with Azure AD B2C and browser navigation after logging in is not uncommon. This can often be due to the caching behavior of browsers or how Azure AD B2C handles the session. Here are some steps you can take to address this issue: 1. Page Caching: Ensure that your application's pages are not being cached by the browser. You can do this by setting appropriate cache-control headers in your responses. This will prevent the browser from showing cached pages when navigating back. In ASP.NET Core, you can set cache control in the `Startup.cs` file's `ConfigureServices` method using the `AddHttpCacheHeaders` method: services.AddHttpCacheHeaders( (expirationModelOptions) => { expirationModelOptions.MaxAge = 600; }, (validationModelOptions) => { validationModelOptions.MustRevalidate = true; }); 2. Session Management: Azure AD B2C sessions can be managed using policies and session timeout settings. Make sure you have the appropriate session timeout configured to prevent unexpected behavior when navigating back. 3. Logout and Redirect: Implement proper logout mechanisms in your application. When a user logs out, you should redirect them to Azure AD B2C's logout endpoint. This helps in clearing the session and tokens. You can implement a controller action to initiate the logout and redirect: public IActionResult Logout() { var redirectUrl = Url.Action("Index", "Home", null, Request.Scheme); return SignOut( new AuthenticationProperties { RedirectUri = redirectUrl }, CookieAuthenticationDefaults.AuthenticationScheme); } Ensure that you are using the correct authentication scheme (in this example, it's `CookieAuthenticationDefaults.AuthenticationScheme`). 4. Post-Logout Redirect URI: In your Azure AD B2C application settings, ensure that you have configured the correct "Post-Logout Redirect URI". This is the URL where users will be redirected after logging out from Azure AD B2C. 5. Prompt Behavior: You can also control the behavior of Azure AD B2C when users navigate back to your application after logging in. Use the `prompt` parameter in your login requests to control whether the user should be prompted for credentials again or not. For example: https://yourtenant.b2clogin.com/yourtenant.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_signupsignin1&client_id=your-client-id&redirect_uri=https%3A%2F%2Fyourapp.com%2Fsignin-oidc&response_type=id_token%20token&scope=openid%20your-scope&prompt=login Remember that the behavior might vary based on the browser and the specific configuration of your application and Azure AD B2C. It's recommended to thoroughly test your application's behavior after implementing any changes.