Question

Problem fixed, see below

What I’m doing is this:

Generate random number -> store it in a session -> pass it to facebook with the ‘state’ parameter of Facebook’s OAuth service -> verify that the returned state is the same as the state in my session (this is done for CSRF protection).

This always worked, no problem. But somehow, it’s not working any longer (the Session seems to be empty because I’m getting a NullReferenceException when I try to read it). I probably changed something, but I can’t find out what.

I tried setting breakpoints in the part of the code where the state is returned by facebook, but somehow it will never hit the breakpoints… The code between my breakpoints get executed, but my breakpoints are not hit.

This is the code that is executing everything:

public ActionResult SignUpButton()
{
    int random = RandomHelpers.GetRandomInteger(null);
    Session.Add("facebookState", random.ToString(CultureInfo.InvariantCulture));

    ViewBag.Uri = "https://www.facebook.com/dialog/oauth?" +
        "client_id=" + _facebookAuthenticationService.GetAppId() + 
        "&redirect_uri=" + _facebookAuthenticationService.GetReturnUri() + 
        "&scope=email" +
        "&state=" + random;

    return PartialView();
}

public ActionResult Register()
{
    string error = Request.QueryString["error"];
    string state = Request.QueryString["state"];
    string originalState = Session["facebookState"].ToString();

(I removed the rest for brevity). The SignUpButton function returns a partial view containing a button with the sign up URL that leads to facebook. Facebook returns to localhost:xxx/Account/Register (that’s the Register function), this functions gets hit (although that breakpoints in Register don’t do anything), and an exception is thrown on the Session[“facebookState”].ToString() part.

This is what my session-related settings in web.config look like:

<sessionState mode="InProc">
  <providers>
    <add name="DefaultSessionProvider" type="System.Web.Providers.DefaultSessionStateProvider, System.Web.Providers, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
  </providers>
</sessionState>

I just can’t figure it out. I already rewritten the code so that it no longer produces errors and returns data from the facebook graph API, but it’s just not acceptable that I can’t debug that part of the code (for the record: breakpoints in the SingUpButton method are hit).

I hope anyone can help me out. Thanks in advance!

Answer 1

Oh god, that was stupid. Just after posting this (after looking for a solution for like 2 hours) I found out what the problem was:

Visual Studio changed the port that my application was running on. I set that to a fixed port (right click MVC project -> web -> specific port) and now it’s working fine.

I feel stupid now…