thinktecture/Thinktecture.IdentityServer.v3 — pull request #686 by ca-ta (2014-12-28 01:18:38+00:00)
Title: Fixed error in message cookie purge algorithm, preventing users from log...

...ging in upon data protection key change.

Purging message cookies failed with an unhandled exception when at least one cookie existed that was encrypted with a key different from the one used by the current IDataProtector.

In this circumstance, the attempt to decrypt the cookie caused an exception to be thrown and resulted in the user being unable to log in. The only (unacceptable) workaround was to delete the cookies in the browser.

While it is true that one may craft and use a DataProtectionprovider other than the default one (DpapiDataProtectionProvider) and conceivably avoid the issue, I believe the server should be intrinsically resilient to malformed cookies – hence the proposed change.

Cheers, and thanks for your work!

P.S. I've signed the [Contributor License Agreement](https://cla.dotnetfoundation.org/), should be in your inbox.