Redirect loop (302) B2C (bug)

[jonnekleijer]

After redeployment of the static web app, the b2c login fails. It redirects around 70 times and then fails.
Previously, this was working ok. I deployed this afternoon since some time.

When changing to use the .referrer as suggested by ms docs the url ends up like this (after many redirects):

"https://someurl.azurestaticapps.net/.auth/login/aadb2c?post_login_redirect_uri=/.auth/login/aadb2c?post_login_redirect_uri%3d/.auth/login/aadb2c?post_login_redirect_uri%253d/.auth/login/aadb2c?post_login_redirect_uri%25253d/.auth/login/aadb2c?post_login_redirect_uri%2525253d/.auth/login/aadb2c?post_login_redirect_uri%252525253d/.auth/login/aadb2c?post_login_redirect_uri%25252525253d/.auth/login/aadb2c?post_login_redirect_uri%2525252525253d/.auth/login/aadb2c?post_login_redirect_uri%252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%25252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%2525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%25252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%2525252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%252525252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%25252525252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%2525252525252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%252525252525252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%25252525252525252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%2525252525252525252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%252525252525252525252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%25252525252525252525252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%2525252525252525252525252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%252525252525252525252525252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%25252525252525252525252525252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%2525252525252525252525252525252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%252525252525252525252525252525252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%25252525252525252525252525252525252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%2525252525252525252525252525252525252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%252525252525252525252525252525252525252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%25252525252525252525252525252525252525252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%2525252525252525252525252525252525252525252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%252525252525252525252525252525252525252525252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%25252525252525252525252525252525252525252525252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%2525252525252525252525252525252525252525252525252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%252525252525252525252525252525252525252525252525252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%25252525252525252525252525252525252525252525252525252525252525252525253d/.auth/login/aadb2c?post_login_redirect_uri%2525252525252525252525252525252525252525252525252525252525252525252525253d/api"

staticwebapp.config.json:

{
  "routes": [
    {
      "route": "/login",
      "rewrite": "/.auth/login/aadb2c"
    },
    {
      "route": "/logout",
      "redirect": "/.auth/logout",
      "allowedRoles": ["authenticated"]
    },
    {
      "route": "/api",
      "rewrite": "/api/swagger/ui",
      "allowedRoles": ["authenticated"]
    },
    {
      "route": "/.auth/login/twitter",
      "statusCode": 404
    },
    {
      "route": "/.auth/login/google",
      "statusCode": 404
    },
    {
      "route": "/.auth/login/aad",
      "statusCode": 404
    },
    {
      "route": "/manifest.json",
      "allowedRoles": ["anonymous", "authenticated"]
    },
    {
      "route": "/api/roles",
      "allowedRoles": ["anonymous", "authenticated"]
    },
    {
      "route": "/api/*",
      "allowedRoles": ["anonymous", "authenticated"]
    },
    {
      "route": "/",
      "redirect": "https://subsidieaanvragen.nl/kies-je-gemeente/",
      "statusCode": 301
    },
    {
      "route": "/*",
      "allowedRoles": ["authenticated"]
    }
  ],
  "navigationFallback": {
    "rewrite": "/index.html"
  },
  "responseOverrides": {
    "401": {
      "statusCode": 302,
      "redirect": "/.auth/login/aadb2c"
    }
  },
  "auth": {
    "rolesSource": "/api/Roles",
    "identityProviders": {
      "customOpenIdConnectProviders": {
        "aadb2c": {
          "registration": {
            "clientIdSettingName": "AADB2C_PROVIDER_CLIENT_ID",
            "clientCredential": {
              "clientSecretSettingName": "AADB2C_PROVIDER_CLIENT_SECRET"
            },
            "openIdConnectConfiguration": {
              "wellKnownOpenIdConfiguration": "https://{AZURE_AD_TENANT}.b2clogin.com/{AZURE_AD_TENANT}.onmicrosoft.com/B2C_1_signup_signin/v2.0/.well-known/openid-configuration"
            }
          },
          "login": {
            "nameClaimType": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
            "scopes": [],
            "loginParameterNames": []
          },
          "enabled": true
        }
      }
    }
  },
  "platform": {
    "apiRuntime": "dotnet-isolated:6.0"
  }
}

[jonnekleijer]

Closing because I made a mistake in the release pipeline. The pipeline removed the app_settings in the swa, resulting in a wrong wellKnownOpenIdConfiguration.

Related issue, which I anticipated was already supported.
hashicorp/terraform-provider-azurerm#13451