# Unable to unprotect the message.State when using two Auth0 clients in one ASP.NET Core app

**URL:** <https://community.auth0.com/t/unable-to-unprotect-the-message-state-when-using-two-auth0-clients-in-one-asp-net-core-app/117913>\
**Category:** Get Help\
**Tags:** configuration, application\
**Created:** [October 5, 2023, 4:22pm UTC](https://community.auth0.com/t/unable-to-unprotect-the-message-state-when-using-two-auth0-clients-in-one-asp-net-core-app/117913 "2023-10-05T16:22:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mdekker](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mdekker/32/60257_2.png) [@mdekker](https://community.auth0.com/u/mdekker)\
**Post date:** [October 5, 2023, 4:22pm UTC](https://community.auth0.com/t/unable-to-unprotect-the-message-state-when-using-two-auth0-clients-in-one-asp-net-core-app/117913/1 "2023-10-05T16:22:43Z")

</div>

I configured 2 Auth0 clients in a [ASP.NET](http://ASP.NET) Core application in the startup:

```auto
   // Configure authentication for Auth0 for students
            // Scope:
            // - openid: to indicate that the application intends to use OIDC to verify the user's identity (always).
            // - profile: to get name, nickname, and picture
            // - email: to get email and email_verified
            services.AddAuth0WebAppAuthentication(CPConstants.AuthenticationSchemeStudent, options =>
            {
                options.Domain = Configuration["Auth0Student:Domain"];
                options.ClientId = Configuration["Auth0Student:ClientId"];
                options.ClientSecret = Configuration["Auth0Student:ClientSecret"];
                options.Scope = "openid profile email";
                options.ResponseType = "code";
                options.MaxAge = new TimeSpan(3, 0, 0);
                options.CookieAuthenticationScheme = CPConstants.CookieAuthenticationSchemeStudent;
            });

            // Configure authentication for Auth0 for external users
            // Scope:
            // - openid: to indicate that the application intends to use OIDC to verify the user's identity (always).
            // - profile: to get name, nickname, and picture
            // - email: to get email and email_verified
            services.AddAuth0WebAppAuthentication(CPConstants.AuthenticationSchemeExternalUser, options =>
            {
                options.Domain = Configuration["Auth0ExternalUser:Domain"];
                options.ClientId = Configuration["Auth0ExternalUser:ClientId"];
                options.ClientSecret = Configuration["Auth0ExternalUser:ClientSecret"];
                options.Scope = "openid profile email";
                options.ResponseType = "code";
                options.MaxAge = new TimeSpan(3, 0, 0);
                options.CookieAuthenticationScheme = CPConstants.CookieAuthenticationSchemeExternalUser;
            });

```

The first one works well. When I add the second (ExternalUser) as Authorize attribute on another controller:

```auto
   [Authorize(AuthenticationSchemes = CPConstants.AuthenticationSchemeExternalUser)]

```

And do a succesfull login when redirected to Auth0, it returns to my MVC application with the following error:

 ![image](https://global.discourse-cdn.com/auth0/original/3X/6/5/65881f7893607f267bb795b73406464b3903a495.png)

---

<div class="post-metadata">

**Author:** ![mario.mont](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mario.mont/32/60295_2.png) [@mario.mont](https://community.auth0.com/u/mario.mont)\
**Post date:** [October 18, 2024, 2:47pm UTC](https://community.auth0.com/t/unable-to-unprotect-the-message-state-when-using-two-auth0-clients-in-one-asp-net-core-app/117913/2 "2024-10-18T14:47:18Z")

</div>

Were you able to solve this?

---

<div class="post-metadata">

**Author:** ![mdekker](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mdekker/32/60257_2.png) [@mdekker](https://community.auth0.com/u/mdekker)\
**Post date:** [October 20, 2024, 2:31pm UTC](https://community.auth0.com/t/unable-to-unprotect-the-message-state-when-using-two-auth0-clients-in-one-asp-net-core-app/117913/3 "2024-10-20T14:31:45Z")

</div>

Hi mario, it is fixed and I think it had to do with the CallbackPath (configure that in Auth0 as well), in startup ConfigureServices we now have this:

```auto
           // Configure authentication for Auth0 for students
            // Scope:
            // - openid: to indicate that the application intends to use OIDC to verify the user's identity (always).
            // - profile: to get name, nickname, and picture
            // - email: to get email and email_verified
            services.AddAuth0WebAppAuthentication(CPConstants.AuthenticationSchemeStudent, options =>
            {
                options.CookieAuthenticationScheme = CPConstants.CookieAuthenticationSchemeStudent;
                options.CallbackPath = "/Student/callback";
                options.Domain = Configuration["Auth0Student:Domain"];
                options.ClientId = Configuration["Auth0Student:ClientId"];
                options.ClientSecret = Configuration["Auth0Student:ClientSecret"];
                options.Scope = "openid profile email";
                options.ResponseType = "code";
                options.MaxAge = new TimeSpan(3, 0, 0);
            });

            // Configure authentication for Auth0 for external users
            // Scope:
            // - openid: to indicate that the application intends to use OIDC to verify the user's identity (always).
            // - profile: to get name, nickname, and picture
            // - email: to get email and email_verified
            services.AddAuth0WebAppAuthentication(CPConstants.AuthenticationSchemeExternalUser, options =>
            {
                options.CookieAuthenticationScheme = CPConstants.CookieAuthenticationSchemeExternalUser;
                options.CallbackPath = "/ExternalUser/callback";
                options.Domain = Configuration["Auth0ExternalUser:Domain"];
                options.ClientId = Configuration["Auth0ExternalUser:ClientId"];
                options.ClientSecret = Configuration["Auth0ExternalUser:ClientSecret"];
                options.Scope = "openid profile email";
                options.ResponseType = "code";
                options.MaxAge = new TimeSpan(3, 0, 0);
     });

```

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 24, 2025, 7:27pm UTC](https://community.auth0.com/t/unable-to-unprotect-the-message-state-when-using-two-auth0-clients-in-one-asp-net-core-app/117913/4 "2025-03-24T19:27:01Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.