Umbraco v13.7.0 with basic authentication in IIS enabled causes backoffice login 500 error

[tonyw195]

Which Umbraco version are you using? (Please write the exact version, example: 10.1.0)

13.7.0

Bug summary

• Just upgraded from v13.6.0 to v13.7.0.
• Logged into backoffice.
• Backoffice try's to login user but causes a 500 error.
• Problem does not happen when we turn off basic authentication in IIS.
• We have always run basic authentication in IIS on all versions of Umbraco 13 and never experienced this issue.

Specifics

No response

Steps to reproduce

• Have Umbraco 13.7.0 running.
• Basic authentication is enabled in IIS for a 401 challenge.
• Log into backoffice.
• Backoffice try's to login user but fails with a 500 error.

Expected result / actual result

Backoffice log's in user but instead causes 500 error.

---

This item has been added to our backlog AB#49888

[github-actions]

Hi there @tonyw195!

Firstly, a big thank you for raising this issue. Every piece of feedback we receive helps us to make Umbraco better.

We really appreciate your patience while we wait for our team to have a look at this but we wanted to let you know that we see this and share with you the plan for what comes next.

• We'll assess whether this issue relates to something that has already been fixed in a later version of the release that it has been raised for.
• If it's a bug, is it related to a release that we are actively supporting or is it related to a release that's in the end-of-life or security-only phase?
• We'll replicate the issue to ensure that the problem is as described.
• We'll decide whether the behavior is an issue or if the behavior is intended.

We wish we could work with everyone directly and assess your issue immediately but we're in the fortunate position of having lots of contributions to work with and only a few humans who are able to do it. We are making progress though and in the meantime, we will keep you in the loop and let you know when we have any questions.

Thanks, from your friendly Umbraco GitHub bot 🤖 🙂

[AndyButland]

I've been able to replicate the issue here, as follows:

• Published the latest v13/dev to an output folder with:

cd ..\src\Umbraco.Web.UI
dotnet publish --output "c:\temp\umbraco13" --configuration Release

• Updated the connection string to a local SQL user, e.g.:

Server=.\\SQLEXPRESS;Database=UmbracoCms13;User Id={user id};Password={password};Encrypt=false

• Created a website in IIS Manager with the following details:
  • Binding of http and https with umbraco-13.local
  • Physical path of C:\Temp\umbraco13
  • Application pool set up with .NET CLR version of "No Managed Code"
  • Under "Authentication" disabled anonymous access and enabled basic authentication
    • To find "Basic authentication" I had to first turn on the windows feature
• Added the following my local hosts file:

127.0.0.1       umbraco-13.local

• Created a local user under Computer Management > Local User and Groups
• Browsed to https://umbraco-13.local
• Sign-in with the local user via the browser basic authentication prompt
• Browsed to https://umbraco-13.local/umbraco
• Sign in as a back-office user
• On submitting the form we get a 500 response.
• In the log we find:

System.InvalidOperationException: Collection was modified; enumeration operation may not execute.
   at System.Collections.Generic.List`1.Enumerator.MoveNext()\r\n   at System.Linq.Enumerable.WhereListIterator`1.MoveNext()
   at System.Collections.Generic.List`1.AddRange(IEnumerable`1 collection)
   at Umbraco.Extensions.HttpContextExtensions.AuthenticateBackOfficeAsync(HttpContext httpContext) in C:\\repos\\Umbraco\\Umbraco.CMS-V13\\src\\Umbraco.Web.Common\\Extensions\\HttpContextExtensions.cs:line 72
   at Umbraco.Cms.Web.BackOffice.Controllers.BackOfficeServerVariables.BareMinimumServerVariablesAsync()
...

[AndyButland]

This is fixed via #18527 and currently targeted for 13.8 due April 10 (with a release candidate available two weeks prior).

However this is a regression from 13.6 if it's causing significant issues for you @tonyw195 - or anyone else following the issue - we can look to arrange for a patch release. Please let us know.

[jillblhoskins]

Yes @AndyButland please can this be arranged as a patch release as soon as possible.

[CodingDK]

@AndyButland - Is a new patch release planned after the security patch 13.7.1 ?
We have a lot of 13.6 sites - but we will not update to 13.7.1 - If it results in users not being able to log in to the back office. We have already experienced this on one solution.