title: Auth0 Authentication not working when callbackurl is a directory
body: <p>I'm having a hard time finding the right words to google I think. I am integrating Auth0 into a new web site, and I have followed the quick start tutorial for a AS.NET MVC site.</p>
  
  <p>When I set the Allowed Callback to be <a href="https://localhost:44334" rel="nofollow noreferrer">https://localhost:44334</a>, everything works like a charm. I can log in, I see the cookie created,all of it.</p>
  
  <p>But, when I set the Allowed Callback to be <a href="https://localhost:44334/anyFolderHere" rel="nofollow noreferrer">https://localhost:44334/anyFolderHere</a>, I get nothing.  The site redirects to Auth0, I can log in, and I get redirected to the correct location. But no cookie, no auth token, nothing.</p>
  
  <p>I can see in the Auth0 logs that it thinks everything went fine, login successful. I see no errors being thrown in my code, I just get nothing.</p>
  
  <p>The code I have is almost line-for-line from their quick start. I am hesitant to start making changes until I can see it working...</p>
  
  <p>I'm sure I am making a rookie mistake here, but I'm getting frustrated and just can't see past myself.</p>
  
  <p>Here is what I have:</p>
  
  <pre><code>public class Startup
  {
      /// &lt;summary&gt;
      /// Configure OWIN to use OpenIdConnect 
      /// &lt;/summary&gt;
      /// &lt;param name="app"&gt;&lt;/param&gt;
      public void Configuration(IAppBuilder app)
      {
          // Configure Auth0 parameters
          string auth0Domain = System.Configuration.ConfigurationManager.AppSettings["auth0:Domain"];
          string auth0ClientId = System.Configuration.ConfigurationManager.AppSettings["auth0:ClientId"];
          string auth0ClientSecret = System.Configuration.ConfigurationManager.AppSettings["auth0:ClientSecret"];
          string auth0RedirectUri = System.Configuration.ConfigurationManager.AppSettings["auth0:RedirectUri"];
          string auth0PostLogoutRedirectUri = System.Configuration.ConfigurationManager.AppSettings["auth0:PostLogoutRedirectUri"];
  
          // Enable the Cookie saver middleware to work around a bug in the OWIN implementation
          app.UseKentorOwinCookieSaver();
  
          // Set Cookies as default authentication type
          app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
          app.UseCookieAuthentication(new CookieAuthenticationOptions
          {
              AuthenticationType = CookieAuthenticationDefaults.AuthenticationType,
              LoginPath = new PathString("/Account/Login")
          });
  
          // Configure Auth0 authentication
          app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
          {
              AuthenticationType = "Auth0",
  
              Authority = $"https://{auth0Domain}",
  
              ClientId = auth0ClientId,
              ClientSecret = auth0ClientSecret,
  
              RedirectUri = auth0RedirectUri,
              PostLogoutRedirectUri = auth0PostLogoutRedirectUri,
  
              ResponseType = OpenIdConnectResponseType.CodeIdToken,
              Scope = "openid profile",
  
              TokenValidationParameters = new TokenValidationParameters
              {
                  NameClaimType = "name"
              },
  
              Notifications = new OpenIdConnectAuthenticationNotifications
              {
                  RedirectToIdentityProvider = notification =&gt;
                  {
                      if (notification.ProtocolMessage.RequestType == OpenIdConnectRequestType.Logout)
                      {
                          var logoutUri = $"https://{auth0Domain}/v2/logout?client_id={auth0ClientId}";
  
                          var postLogoutUri = notification.ProtocolMessage.PostLogoutRedirectUri;
                          if (!string.IsNullOrEmpty(postLogoutUri))
                          {
                              if (postLogoutUri.StartsWith("/"))
                              {
                                  // transform to absolute
                                  var request = notification.Request;
                                  postLogoutUri = request.Scheme + "://" + request.Host + request.PathBase + postLogoutUri;
                              }
                              logoutUri += $"&amp;returnTo={ Uri.EscapeDataString(postLogoutUri)}";
                          }
  
                          notification.Response.Redirect(logoutUri);
                          notification.HandleResponse();
                      }
                      return Task.FromResult(0);
                  }
              }
          });
      }
  }
  
  
  public class AccountController : Controller
      {
          public ActionResult Login(string returnUrl)
          {
              HttpContext.GetOwinContext().Authentication.Challenge(new AuthenticationProperties
                  {
                      RedirectUri = returnUrl ?? Url.Action("Index", "Home")
                  },
                  "Auth0");
              return new HttpUnauthorizedResult();
          }
  
          [Authorize]
          public void Logout()
          {
              HttpContext.GetOwinContext().Authentication.SignOut(CookieAuthenticationDefaults.AuthenticationType);
              HttpContext.GetOwinContext().Authentication.SignOut("Auth0");
          }
      }
  </code></pre>
  
  <p>EDIT:  I added event handlers for AuthenticationFailed, AuthorizationCodeReceived, MessageReceived, SecurityTokenReceived and SecurityTokenValidated. Those handles do NOT fire when calling https://{host}/anyFolderHere. However they DO fire when just coming from https://{host}/.</p>
  
  <p>code added, with breakpoints in the debugger at each step.</p>
  
  <pre><code> },AuthenticationFailed = failed =&gt;
                      {
                          return Task.FromResult(0);
                      },
                      AuthorizationCodeReceived = received =&gt;
                      {
                          return Task.FromResult(0);
                      },
                      MessageReceived = message =&gt;
                      {
                          return Task.FromResult(0);
                      },
                      SecurityTokenReceived = token =&gt;
                      {
                          return Task.FromResult(0);
                      },
                      SecurityTokenValidated = validate =&gt;
                      {
                          return Task.FromResult(0);
                      }
  </code></pre>