MVC5 Null Reference with facebook login

Question

Im getting an null reference exception sometimes when I login with facebook using the out of the box ASP.NET mvc5 accounts controller.

---

Here is the dieing method :

public async Task<ActionResult> ExternalLoginCallback(string returnUrl)
{
        // Crashes on this line
        var loginInfo = await AuthenticationManager.GetExternalLoginInfoAsync();
        if (loginInfo == null)
        {
            return RedirectToAction("Login");
        }
}

---

Im not sure how to debug this. A breakpoint and steeping though the code is no help... I end up looking at my Error.cshtml page. The error at that point is a simple object reference null exception and the inner exception is also null.

---

Edit

I updated to the latest Owins via Nuget, no change.

Edit 2

Took a look in fiddler, Facebook is returning a 200 with what looks like a correct profile as json.

Edit 3

So strange. Im testing with 3 facebook accounts. Two accounts are working fine, 1 does not. The failing one is returning with 200. I have removed the app references in facebook.. I get a app confirmation window, I click ok, and it dies.... so strange.

Answer 1

A quick solution for now.

You have to clear the Session before ExternalLoginCallback. Example.

[HttpPost]
[AllowAnonymous]
[ValidateAntiForgeryToken]
public ActionResult ExternalLogin(string provider, string returnUrl)
{
    ControllerContext.HttpContext.Session.RemoveAll();

    // Request a redirect to the external login provider
    return new ChallengeResult(provider, Url.Action("ExternalLoginCallback", "Account", new { ReturnUrl = returnUrl }));
}

Answer 2

Upgrading my Owin components from version 3.0.1 to version 3.1.0 fixed this (so far). 3.1.0 was released April 10, 2017.

Answer 3

Clearing the Session as per the reply from Lee (marked as the answer) resolved this issue for us too. We have a pretty stock standard ASP.NET MVC 4 web app with Google and Facebook login also enabled running on Azure Websites and this was driving us nuts.

It would stop working every 12 - 24 hours or somewhere around that time period and restarting the website would make it work for the next period until it happened again.

I do however wonder why clearing the session works... it smells a bit like a framework bug (or perhaps an Azure bug in our case) unless I'm missing something.