I was having the same problem with the vanilla ASP.NET 6 template with Azure AD auth, except that everything worked fine locally, but I received the Unable to unprotect the message.State. error when I deployed it to our kubernetes cluster.
For me, the issue was that the application was deployed to more than one instance behind the load balancer, so that caused the issues. I came across this issue on GitHub, which pointed me to this article that describes the problem and solution.
Solution 1
The article recommended utilizing a centralize data store that can be shared by all running instances to hold the auth keys, and set it up with code similar to this.
services.AddDataProtection()
.SetApplicationName("MyApp")
.SetDefaultKeyLifetime(TimeSpan.FromDays(30))
.PersistKeysToAzureBlobStorage(new Uri("https://mystore.blob.core.windows.net/keyrings/master.xml"), new DefaultAzureCredential())
.ProtectKeysWithAzureKeyVault(new Uri("https://myvault.vault.azure.net/keys/MasterEncryptionKey"), new DefaultAzureCredential());
Solution 2
My web app didn't utilize a database and I didn't want to introduce one just for auth, so instead I configured our ingress to use cookie persistence. This means that when a request is made, the response contains a cookie that the client will store and include on future requests. The cookie tells the ingress which instance to direct the request to, ensuring that requests from a specific client always end up hitting the same instance.
This may not be ideal in all scenarios, as it can prevent the load balancer from performing equal distribution of requests across all instances. That tradeoff was fine in my scenario though, as it's not a high volume service, and this is the solution I ended up using.
Here's an example of the nginx ingress yaml annotations I added:
ingress:
enabled: true
annotations:
nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
nginx.ingress.kubernetes.io/affinity: cookie
nginx.ingress.kubernetes.io/session-cookie-name: my-service-name
nginx.ingress.kubernetes.io/session-cookie-hash: sha1
nginx.ingress.kubernetes.io/session-cookie-max-age: "1800"
You can configure a similar cookie affinity rule in other products, like F5 load balancers, Azure App Gateways, etc.
Solution 3
The last option is to host only a single instance of your service, in which case all auth callbacks will hit that single service. This isn't ideal though, as it means you can't scale your web app for high availability.
How this relates to the original poster's issue of getting this error on their localhost while debugging, I'm not certain. Perhaps they have more than once instance running on their local machine, or a reverse proxy, or interceptor (like Fiddler) running on their localhost that is causing the problem? Either way, I thought I'd share my solutions for others that stumble across this question when searching for the error message.
