Upgrade to Duende 7.1.0 causes HTTP 431 errors

[rabberbock]

Which version of Duende IdentityServer are you using?
7.1.0

Which version of .NET are you using?
.NET 9

Describe the bug

We just upgraded to .NET 9 and upgraded Duende packages as well and many of our clients are seeing 431 errors. This only started once we made the .NET 9 version live. It was really only package upgrades across our app, so wondering if you know of anything offhand that would cause this. We have since reverted our deployment and the amount of 431 is consistently decreasing.

To Reproduce

I will try to reproduce this when I get a chance.

Expected behavior

No 431 errors.

Log output/exception with stacktrace

Additional context

[RolandGuijt]

Can you please provide some more information?

• In which request are your experiencing the 431? Is it a request to IdentityServer? If so which endpoint? Or is it a request to an API?
• Where is the application your sending the request to deployed?

[rabberbock]

@RolandGuijt The request endpoint is /connect/authorize. Our users are redirected to our SSO when needing to login to our frontend (a Blazor WASM app).

[RolandGuijt]

How is the Blazor WASM app configured? Is it using a BFF or is there some other setup?
Can you please share the code that accesses the endpoint?

[rabberbock]

@RolandGuijt I am not using BFF. We are using jwt tokens to authenticate to our API.

@page "/authentication/{action}"

<RemoteAuthenticatorView Action="@Action" OnLogOutSucceeded="LogOutSucceededCallback">
    <LoggingIn>
        <AppSkeletonLoader Text="Logging In..."/>	
    </LoggingIn>
 
etc ...

</RemoteAuthenticatorView>

@code{

    [Parameter]
    public string Action { get; set; }

 etc ...

}

services.AddOidcAuthentication(options =>
{
    options.ProviderOptions.ClientId = "clientId";
    options.ProviderOptions.Authority = identityServerUrl;
    options.ProviderOptions.ResponseType = "code";
    options.ProviderOptions.DefaultScopes.Add("role");
    options.ProviderOptions.DefaultScopes.Add("ourAPI");
    options.ProviderOptions.DefaultScopes.Add("openid");
    options.ProviderOptions.DefaultScopes.Add("profile");
    options.ProviderOptions.DefaultScopes.Add("email");
    options.AuthenticationPaths.LogInPath = "login";
});

[maartenba]

(note: we're moving this issue to our new community discussions)

[RolandGuijt]

That looks correct. Is it possible for you to see what the header looks like when the request is send to the authorize endpoint? Maybe using the F12 tools in the browser?