CryptographicException when calling _interaction.GetAllUserGrantsAsync() about identityserver HOT 7 CLOSED

@bNobo I have reproduced the error and am looking into possible ways to solve this.

Currently the error handling will call LogError() with the exception and then return an empty collection of grants.

I think that the error logging can be moved to be done per grant. This would log each grant error individually. Those grants that caused a failure are ignored and the rest returned.

An alternative is to collect a list of deserialization/unprotect failures and log an aggregate exception to avoid spamming the logs with individual errors.

I would prefer an aggregate exception to just write one Error log per call to GetAllUserGrantsAsync. @brockallen @josephdecock what do you think?

from identityserver.

I gave it a try and the patch fixed the issue. Thx !

from identityserver.

Thank you for your detailed error report and reproduction steps.

from identityserver.

I don't have a strong opinion here, but it probably is simpler to implement with individual errors logged, and a single value might be slightly easier to consume/search for in a log than a list?

from identityserver.

@AndersAbel is this something we're targeting our 7.0 release for a fix?

from identityserver.

PR merged.

from identityserver.

@bNobo we released patch 6.3.8 for this today, so please give it a try. thanks

from identityserver.