Fix the Server-Side Proxy Route in an ASP.NET Core OIDC Login

A browser reaching the identity provider's login page does not prove that the ASP.NET Core server can fetch provider metadata or exchange a token. Those server-side requests use the OpenID Connect backchannel.

For an existing scheme named oidc, configure its handler during service setup, before authentication requests begin:

services.Configure<Microsoft.AspNetCore.Authentication.OpenIdConnect
    .OpenIdConnectOptions>("oidc", options =>
{
    options.BackchannelHttpHandler =
        new System.Net.Http.HttpClientHandler
        {
            UseProxy = true,
            Proxy = new System.Net.WebProxy(
                "http://proxy.example.net:8080")
        };
});

Replace oidc with the actual registered scheme name. Retain the authority, client and token-validation settings. If the proxy requires an account, attach the intended credentials to WebProxy.

Check whether the app already supplies options.Backchannel as a complete HttpClient. If it does, configure that client's route directly: ASP.NET Core uses BackchannelHttpHandler when creating its default backchannel, not to replace a client already supplied.

Use the server's failed discovery or token request to evaluate this setting. For a public HTTP route, the HTTP proxy list provides candidates for the WebProxy address. Browser proxy policy and unrelated HTTP clients have their own configuration paths.