# Custom State persistence and validation using Asp.net core Open Id Connect (OIDC) middleware

**URL:** <https://community.auth0.com/t/custom-state-persistence-and-validation-using-asp-net-core-open-id-connect-oidc-middleware/45502>\
**Category:** Get Help\
**Tags:** aspnet-core, oidc\
**Created:** [June 30, 2020, 12:50am UTC](https://community.auth0.com/t/custom-state-persistence-and-validation-using-asp-net-core-open-id-connect-oidc-middleware/45502 "2020-06-30T00:50:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rramirez](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rramirez/32/14558_2.png) [@rramirez](https://community.auth0.com/u/rramirez)\
**Post date:** [June 30, 2020, 12:50am UTC](https://community.auth0.com/t/custom-state-persistence-and-validation-using-asp-net-core-open-id-connect-oidc-middleware/45502/1 "2020-06-30T00:50:41Z")

</div>

Hey everyone,

I’m attempting to persist some application state across my Auth0 authentication request, but I’m having trouble finding documentation surrounding how to do it.

I’m using the following technologies:  
[Asp.net](http://Asp.net) core 2.2  
Open Identity Connect (OIDC) middleware  
Web application

So, based on two auth0 documentations it sounds like I should be able to not only persist state through my auth0 authentication requests, but I should also be able to validate the state and reject the request if the state is not valid. Here are the doc links:

- [Prevent Attacks and Redirect Users with OAuth 2.0 State Parameters - Auth0 Docs](https://auth0.com/docs/protocols/oauth2/oauth-state#csrf-attacks)
- [Redirect Users - Auth0 Docs](https://auth0.com/docs/protocols/oauth2/redirect-users)

From reading the documentation, it makes me think that there should be a feature called State or Nonce in the OIDC middleware that I can encode data into. It also seems like the OIDC middleware should have some type of hook/handler where I can validate the response from Auth0 and reject potential CSRF attacks while also being able to retrieve my app state. Unfortunately, I’m at a bit of a loss about if OIDC even has features like this.

This is the closest thing that I’ve found, `OpenIdConnectOptions.NonceCookie`, but it seems different than what I was expecting based on the Auth0 docs linked above.

If someone has a link to some github code, or Auth0 examples that I may have missed that would be greatly appreciated. I’ve been sort of stuck at this point for a week now and not sure how to proceed.

Thanks,  
Ruben

---

<div class="post-metadata">

**Author:** ![rramirez](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rramirez/32/14558_2.png) [@rramirez](https://community.auth0.com/u/rramirez)\
**Post date:** [June 30, 2020, 2:41am UTC](https://community.auth0.com/t/custom-state-persistence-and-validation-using-asp-net-core-open-id-connect-oidc-middleware/45502/2 "2020-06-30T02:41:37Z")

</div>

I was able to figure out a good place to store the state in the OnRedirectToIdentityProvider in the OpenIdConnectEvents,

```
OnRedirectToIdentityProvider = (RedirectContext context) =>
{
	context.ProtocolMessage.State = "CUSTOM_STATE";
	return Task.CompletedTask;
} 

```

This is available as AuthenticationProperties later on in my app. Now I’m trying to find the proper way to deny access to the app given certain criteria in my state? Any insight is GREATLY appreciated 🙂