title: .NET 5 Blazor Server OKTA Authentication showing HTTP Error 400
body: <p>Using ASP.NET Core (.NET 5) Blazor Server with OKTA. OKTA log page has been prompted. I am getting below error messge on submitting OKTA uid/pwd</p>
  <pre><code>HTTP Error 400. The size of the request headers is too long.
  </code></pre>
  <p>My middleware is as like below, using an OpenId Connect.</p>
  <pre><code>services.AddAuthentication(options =&gt;
                             {
                                    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                                    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
                                    options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                             })
                             .AddOpenIdConnect(options =&gt;
                             {
                                    options.RemoteAuthenticationTimeout = TimeSpan.FromMinutes(30);
                                    options.AuthenticationMethod = OpenIdConnectRedirectBehavior.RedirectGet;
                                    options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                                    options.Authority = configuration[&quot;Okta:Domain&quot;] + &quot;/oauth2/default&quot;;
                                    options.RequireHttpsMetadata = true;
                                    options.ClientId = configuration[&quot;Okta:ClientId&quot;];
                                    options.ClientSecret = configuration[&quot;Okta:ClientSecret&quot;];
                                    options.ResponseMode = OpenIdConnectResponseMode.FormPost;
                                    options.ResponseType = OpenIdConnectResponseType.Code;
                                    options.Scope.Add(&quot;offline_access&quot;);
                                    options.UseTokenLifetime = true;
                                    options.GetClaimsFromUserInfoEndpoint = true;
                                    options.AccessDeniedPath = &quot;/Public/AccessDenied&quot;;
                                    options.Scope.Add(&quot;openid&quot;);
                                    options.Scope.Add(&quot;profile&quot;);
                                    options.Scope.Add(&quot;email&quot;);
  
                                    // Describe how to map the user info we receive to user claims
                                    options.ClaimActions.MapJsonKey(ClaimTypes.NameIdentifier, &quot;sub&quot;, &quot;string&quot;);
                                    options.ClaimActions.MapJsonKey(ClaimTypes.GivenName, &quot;given_name&quot;, &quot;string&quot;);
                                    options.ClaimActions.MapJsonKey(ClaimTypes.Name, &quot;given_name&quot;, &quot;string&quot;);
                                    options.ClaimActions.MapJsonKey(&quot;LastName&quot;, &quot;lastname&quot;, &quot;string&quot;);
                                    options.ClaimActions.MapJsonKey(&quot;FirstName&quot;, &quot;firstname&quot;, &quot;string&quot;);
                                    options.ClaimActions.MapJsonKey(ClaimTypes.Email, &quot;email&quot;, &quot;string&quot;);
                                    options.ClaimActions.MapJsonKey(&quot;Groups&quot;, &quot;Groups&quot;, &quot;string&quot;);
                                    options.ClaimActions.MapJsonKey(&quot;membership_roles&quot;, &quot;membership_roles&quot;, &quot;string&quot;);
  
                                    options.SaveTokens = true;
                                    options.NonceCookie.SameSite = SameSiteMode.Unspecified;
                                    options.CorrelationCookie.SameSite = SameSiteMode.Unspecified;
  
                                    options.TokenValidationParameters = new TokenValidationParameters
                                    {
                                           NameClaimType = &quot;name&quot;,
                                           RoleClaimType = &quot;groups&quot;,
                                           RequireSignedTokens = true,
                                           ValidateIssuer = false
                                    };
                             })
                             .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme, displayName: $&quot;EPDOne_{GlobalVariables.LocalEnv.EnvironmentName}&quot;,
                          options =&gt;
                          {
  
                                options.Cookie.Name = $&quot;EPDOne_{ GlobalVariables.LocalEnv.EnvironmentName}&quot;;
                                options.Cookie.HttpOnly = false;
                                 options.Cookie.SecurePolicy = CookieSecurePolicy.SameAsRequest;
                                options.Cookie.IsEssential = true;
  
  
                                options.Events = new CookieAuthenticationEvents
                                {
                                       // this event is fired everytime the cookie has been validated by the cookie middleware,
                                       // so basically during every authenticated request
                                       // the decryption of the cookie has already happened so we have access to the user claims
                                       // and cookie properties - expiration, etc..
                                       OnValidatePrincipal = context =&gt;
                                       {
                                              // since our cookie lifetime is based on the access token one,
                                              // check if we're more than halfway of the cookie lifetime
  
                                              var now = DateTimeOffset.UtcNow;
                                              TimeSpan timeElapsed = now.Subtract(DateTime.Now.AddDays(1));
                                              TimeSpan timeRemaining = now.Subtract(DateTime.Now.AddDays(2));
                                              if (context is not null)
                                              {
                                                     if (context.Properties is not null &amp;&amp; context.Properties.IssuedUtc is not null)
                                                     {
                                                            timeElapsed = now.Subtract(context.Properties.IssuedUtc.Value);
                                                     }
                                                     else
                                                     {
                                                            context.ShouldRenew = true;
                                                     }
                                                     if (context.Properties is not null &amp;&amp; context.Properties.ExpiresUtc is not null)
                                                     {
                                                            timeRemaining = context.Properties.ExpiresUtc.Value.Subtract(now);
                                                     }
                                                     else
                                                     {
                                                            context.ShouldRenew = true;
                                                     }
                                              }
  
  
                                              if (timeElapsed &gt; timeRemaining || context?.ShouldRenew == true)
                                              {
                                                     context.ShouldRenew = true;
  
                                                     var identity = (ClaimsIdentity)context?.Principal?.Identity;
                                                     if (identity is not null &amp;&amp; identity.IsAuthenticated)
                                                     {
                                                            string CurrentBaseAddress = CurrentURL(context.HttpContext);
                                                            string returnUrl = &quot;&quot;;
                                                            if (string.IsNullOrEmpty(CurrentBaseAddress) == false)
                                                            {
                                                                   returnUrl = &quot;?returnUrl=&quot; + CurrentBaseAddress;
                                                            }
                                                            context.Response.Redirect(GlobalVariables.OKTACallBackURI + $&quot;/refresh{returnUrl}&quot;);
                                                     }
                                              }
  
                                              return Task.CompletedTask;
                                       }
                                };
                          });
  
  
                             services.AddRazorPages(options =&gt;
                             {
                                    options.Conventions.AuthorizeFolder(&quot;/&quot;);
                                    //options.Conventions.AllowAnonymousToFolder(&quot;/Public&quot;);
                             }
                             );
  </code></pre>
  <p>As you can see above, I used OpenId in Startup.cs and application is prompting with OKTA credential dialog and after submitting uid/pwd, page behaves like in a loop and then shows the HTTP Error 400 message. Any clues here?</p>