From c82db3ac5a89db4125844d2a570009b22dd09919 Mon Sep 17 00:00:00 2001 From: Luke Latham <1622880+guardrex@users.noreply.github.com> Date: Tue, 19 Mar 2024 11:16:59 -0400 Subject: [PATCH] Nonce update for token refresh (#32081) --- aspnetcore/blazor/security/blazor-web-app-with-oidc.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/aspnetcore/blazor/security/blazor-web-app-with-oidc.md b/aspnetcore/blazor/security/blazor-web-app-with-oidc.md index 82ba0d1637..513386142e 100644 --- a/aspnetcore/blazor/security/blazor-web-app-with-oidc.md +++ b/aspnetcore/blazor/security/blazor-web-app-with-oidc.md @@ -570,6 +570,14 @@ The important changes to the `LogInOrOut` component are demonstrated in the foll ``` +## Cryptographic nonce + +A *nonce* is a string value that associates a client's session with an ID token to mitigate [replay attacks](https://developer.mozilla.org/docs/Glossary/Replay_attack). + +If you receive a nonce error during authentication development and testing, use a new InPrivate/incognito browser session for each test run, no matter how small the change made to the app or test user because stale cookie data can lead to a nonce error. For more information, see the [Cookies and site data](#cookies-and-site-data) section. + +A nonce isn't required or used when a refresh token is exchanged for a new access token. In the sample app, the `CookieOidcRefresher` (`CookieOidcRefresher.cs`) deliberately sets to `false`. + ## Troubleshoot [!INCLUDE[](~/blazor/security/includes/troubleshoot-server.md)]