I have finally fixed this issue.

Issue:

After upgrading to Umbraco 14.X.X, I could no longer log in to the back office when my Umbraco site was deployed to Azure. Locally, everything worked fine when running through Visual Studio.

Root Cause:

The issue was related to Azure's reverse proxy setup:

Azure Reverse Proxy:

Azure forwards incoming HTTPS requests as HTTP to the internal application. OpenIddict Security Requirement: OpenIddict requires that authentication requests are made over HTTPS in production.

However, since Azure forwards the request internally as HTTP, OpenIddict rejected the requests. Missing X-Forwarded-Proto Handling: Without the correct middleware, my application didn’t recognize the original request was made over HTTPS because it wasn’t interpreting the X-Forwarded-Proto header sent by Azure.

Solution:

To fix this, I added the UseForwardedHeaders() middleware to handle the X-Forwarded-Proto header, which allows the application to recognize that the original request was made over HTTPS.

Here is the relevant part of the solution in Startup.cs:

public void Configure(IApplicationBuilder app, IWebHostEnvironment env, ILogger<Startup> logger)
{
    app.UseRouting();

    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }
    else
    {
        app.UseExceptionHandler("/Home/Error");
        app.UseHsts();
    }

    app.UseHttpsRedirection();
    app.UseStaticFiles();

    // Add the forwarded headers middleware here
    var forwardedHeaderOptions = new ForwardedHeadersOptions
    {
        ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
    };
    forwardedHeaderOptions.KnownNetworks.Clear(); // Removes restrictions on proxy IP addresses
    forwardedHeaderOptions.KnownProxies.Clear(); // Allows Azure proxies to be trusted
    app.UseForwardedHeaders(forwardedHeaderOptions);

    // If certificate forwarding is still required, keep this line
    app.UseCertificateForwarding();

    app.UseAuthentication();
    app.UseAuthorization();

    app.UseCors(builder =>
    {
        builder.AllowAnyOrigin()
               .AllowAnyMethod()
               .AllowAnyHeader();
    });

    app.UseUmbraco()
        .WithMiddleware(u =>
        {
            u.UseBackOffice();
            u.UseWebsite();
        })
        .WithEndpoints(u =>
        {
            u.UseBackOfficeEndpoints();
            u.UseWebsiteEndpoints();
        });
}

Summary:

Azure forwards HTTPS requests as HTTP. OpenIddict requires HTTPS in production. Adding UseForwardedHeaders() ensures the app correctly interprets the X-Forwarded-Proto header and allows HTTPS requests to be recognized, solving the login issue.