Don't apply the CSRF verdict to remote authentication callbacks

[DeagleGross]

Fixes #68666.

A Blazor Web App using AddOpenIdConnect fails the sign-in callback with InvalidOperationException: This form is being accessed with a failed antiforgery validation thrown from FormFeature.ReadFormAsync, inside OpenIdConnectHandler.HandleRemoteAuthenticateAsync.

How this worked in .NET 10 with antiforgery

Token antiforgery is per-endpoint: AntiforgeryMiddleware only validates when the matched endpoint carries IAntiforgeryMetadata with RequiresValidation: true, which Blazor attaches to each routable component endpoint in RazorComponentEndpointFactory. /signin-oidc is not a component endpoint, so it never carried that metadata. More importantly, UseAntiforgery() sits after UseAuthentication(), and RemoteAuthenticationHandler short-circuits the callback as an IAuthenticationRequestHandler — so the antiforgery middleware never ran for the callback at all.

Why CSRF protection triggers now

CsrfProtectionMiddleware is auto-injected and runs in the post-routing pipeline, which EndpointRoutingMiddleware invokes immediately after matching — i.e. before UseAuthentication(), so the auth handler no longer short-circuits ahead of it. It records IAntiforgeryValidationFeature { IsValid = false } plus an HttpContext.Items marker instead of rejecting the request (#67082), deferring the failure to whoever reads the body. For the callback that consumer is the OIDC handler itself, and it reads the form before OnMessageReceived fires, so applications have no way to opt out.

Why the callback is always a cross-site request

With response_mode=form_post the identity provider returns the response as a top-level auto-submitted form POST from its own origin to CallbackPath, so the browser always sends Sec-Fetch-Site: cross-site. That is the exact shape the Fetch Metadata algorithm classifies as a CSRF attempt, and nothing about a legitimate callback distinguishes it at the HTTP layer. form_post is the default for response_type values containing id_token and is what Entra ID and Microsoft.Identity.Web use, so this fails deterministically rather than intermittently. The same applies to WS-Federation and to the OIDC RemoteSignOutPath.

Why suppressing the verdict here is safe

The callback carries its own forgery protection: state round-trips a data-protected AuthenticationProperties payload whose correlation id must match the .AspNetCore.Correlation.* cookie, and ValidateCorrelationId rejects the request when it doesn't. Nonce validation for id_token and PKCE for the code flow apply on top of that, none of which an attacker can forge. The verdict is suppressed only while the handler owns the request and is restored when it declines (SkipHandler / SkipUnrecognizedRequests / exception), so anything the handler hands back to the pipeline still sees the original verdict.

[Copilot]

Pull request overview

This PR fixes a regression where automatic cross-origin CSRF protection records an invalid IAntiforgeryValidationFeature on remote authentication callback requests (e.g., OIDC response_mode=form_post), causing ReadFormAsync to throw before the authentication handler can process the callback.

Changes:

• Introduces a shared helper to temporarily suppress an invalid antiforgery/CSRF verdict while a remote authentication handler processes its owned callback request, restoring it if the handler declines.
• Applies the suppression in RemoteAuthenticationHandler (covers standard remote callbacks) and in OpenIdConnectHandler for its additional callback endpoints.
• Adds integration tests validating that cross-site callback POSTs can be read by the handler, and that the invalid verdict is restored when the handler skips the request.

Show a summary per file

File	Description
src/Shared/RemoteAuthenticationAntiforgery.cs	Adds shared helper to suppress/restore invalid IAntiforgeryValidationFeature during remote handler execution.
src/Security/Authentication/Core/src/RemoteAuthenticationHandler.cs	Wraps callback handling in the suppression helper (covers CallbackPath).
src/Security/Authentication/Core/src/Microsoft.AspNetCore.Authentication.csproj	Links the new shared helper into the authentication core build.
src/Security/Authentication/OpenIdConnect/src/OpenIdConnectHandler.cs	Uses the helper for OIDC-specific callback paths that can read form_post bodies.
src/Security/Authentication/OpenIdConnect/src/Microsoft.AspNetCore.Authentication.OpenIdConnect.csproj	Links the new shared helper into the OpenIdConnect build.
src/DefaultBuilder/test/Microsoft.AspNetCore.Tests/RemoteAuthenticationCsrfTests.cs	Adds tests proving the handler can read cross-site callback forms and that downstream protection is preserved when skipping.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 6/6 changed files
• Comments generated: 0
• Review effort level: Lite