Bad Request - Request Too Long - IIS Server

[kuldeepcis-lab]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

I cloned the repository and started working with the BlazorWebappOidc project. I configured the Entra ID settings, such as the client ID and tenant ID, using the details from my Entra ID tenant account. After running the application locally on the Kestrel server with the HTTPS profile, the Blazor application launched successfully. The interface loaded in the browser, and I was able to log in using my Entra ID account. After a successful callback to my Blazor application URL, I was redirected and received the expected details (Such as Username, email address, etc).

However, when I deployed the same application on an IIS server, I encountered an issue. While the Blazor application opened, when I attempted to log in to my Microsoft Entra ID account, I received a Bad Request - Request Too Long (HTTP Error 400. The size of the request headers is too long) error after the callback.

Expected Behavior

After a successful callback to my Blazor application URL, I was redirected and received the expected details (Such as Username, email address, etc).

Steps To Reproduce

• Go to repository and clone BlazorWebappOidc and Open the application in Visual Studio.

• Provide the needed configuration like Tenant ID, Client ID, etc for your Microsoft Azure Entra ID.

• Add an IIS Settings to launchsettings.json to run the application on IIS locally then Run

"iisSettings": { "windowsAuthentication": false, "anonymousAuthentication": true, "iisExpress": { "applicationUrl": "http://localhost:46294", "sslPort": 44381 } },"profiles": { "IIS Express": { "commandName": "IISExpress", "launchBrowser": true, "inspectUri": "{wsProtocol}://{url.hostname}:{url.port}/_framework/debug/ws-proxy?browser={browserInspectUri}", "environmentVariables": { "ASPNETCORE_ENVIRONMENT": "Development" } } }

• Click on login and it will redirect you to the authentication flow then provide the Credentials for login (Entra ID Username and password).

• After the successful callback you get back to the Blazor Application and then you will see the Error

Bad Request - Request Too Long (HTTP Error 400. The size of the request headers is too long.)

Exceptions (if any)

No response

.NET Version

DOTNET 8

Anything else?

cc: @guardrex dotnet/blazor-samples#344

[martincostello]

Try configuring IIS Request Limits in web.config like this to increase the allowed query string length:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <!-- Any existing configuration you may have -->
+ <system.webServer>
+   <security>
+     <requestFiltering>
+       <requestLimits maxQueryString="4096" />
+     </requestFiltering>
+   </security>
+ </system.webServer>
</configuration>

[kuldeepcis-lab]

Already tried, but Not Worked.

[javiercn]

@kuldeepcis-lab thanks for contacting us.

The request that fails is the one that happens after the logging, isn't it? Seems that too much information might be stored in the auth cookie. (There are 5 chunks at 4Kb per chunk)

So I suspect IIS has a 16KB header limit.

In that situation, you need to either configure a higher limit (not sure if possible) or reduce the amount of information that you put on the cookie.

You can do so by hooking on to the Oidc call and customizing the claims principal https://learn.microsoft.com/en-us/aspnet/core/security/authentication/claims?view=aspnetcore-8.0

[utkarshdubeyfsd]

@kuldeepcis-lab, Try configuring the other IIS limits in the web.config file, such as increasing the request length and content length.

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <system.web>
    <!-- Increase max request length in KB -->
    <httpRuntime maxRequestLength="51200" /> <!-- 50 MB -->
  </system.web>
  
  <system.webServer>
    <security>
      <requestFiltering>
        <!-- Increase max content length in bytes -->
        <requestLimits maxAllowedContentLength="52428800" /> <!-- 50 MB -->
      </requestFiltering>
    </security>
  </system.webServer>
</configuration>

[kuldeepcis-lab]

Hello @utkarshdubeyfsd
I had already tried both of the solutions but did not work at all.

[kuldeepcis-lab]

Hello @javiercn

I had tried setting the header limit to 64 KB, but no luck even after that change.

[guardrex]

@kuldeepcis-lab ... You tried by setting the registry keys?