asp.net mvc - DNOA Errors only on Live Production Servers -

I have a problem in the login process which is only on the live server which is very strange to solve this issue. I am also a little worried I think this is why it is only on the live server, as well as the problem.

I have three examples of the system, I am developing in Visual Studio and using ISExpress for Dev and debugging, I have a wrong "staging" example that I have a local SSL protected IIS web site And then I have a live production environment of the web hosting company in a virtual dedicated server.

I only

is an OAuth protected app hosted in a separate IIS site on an MVC4 web site and server in the site.

The problem

When the logging process has to be entered on the production site, then the user shows twice on the login screen. One click login has been logged properly by the user again.

DNOA error message

DotNetOpenAuth.Messaging.ProtocolException: Unexpected OAuth authorization response with callback and client received state that does not match expected value is.

Code - Account Administrator

  Public Function Login (login model model, string return URL) {if (ModelState .IsValid & SecurityClient .Login (model.Email, model.Password, model.RememberMe)) {ObtainApiOAuthTokens (model.Email, returnUrl); }} Public Zero ObtainMoodexApiOAuthTokens (String Username, String Return URL) {var scopes = SecurityClient.GetOauthScopesForCurrentUser (userName); _client.GetAuthorised (scope, return URL); } Public -> GetAuthorized Public (IEnumerable & lt; string & gt; scopes, string returnUrl) {/ code>  
  code - APIClient   
 If (! String .IsNullOrEmpty (returnUrl)) {var nvc = New name ValueCollection {{"returnUrl", returnUrl}}; RequestUserAuthorization (Scope, New URI (Configuration Manager. AppSettings ["TokenCallbackUrl"] + nvc.ToQueryString (Wrong)); } Other {RequestUserAuthorization (Scope, new URI (Configuration Manager. AppSettings ["TokenCallbackUrl"])); }}  
 
  Code - AccountController - Readtecense  
 
  Public Action Redtecense () {if String.IsNullOrEmpty (Request QueryString ["Code"])) {try {iAuthorizationState Authority = _client.ProcessUserAuthorization (); Authorization Callback = new URI (authorization callback .Get leftpart (UriPartial.Path)); If (! String.IsNullOrEmpty (authorization.AccessToken)) {_client.SaveState (authorization); }} Catch (pre-protocol expression pre) {_log.Fatal ("Error reading security token", prior); }} String [] roles = roles. Petrolforce user (User.Identity.Name); If (roles (AppRole.LicenseManager.ToString ())) {Return RedirectToAction ("Index", "Licenseadman", New {@area = "licensemanager"}); } Return returnUrl = Request.QueryString ["returnUrl"]; If (string.IsNullOrEmpty (returnUrl)) {Return Direct Redirect Action ("Index", "Dashboard"); } Return Redirected Local (return URL); }  
 
 Since I apply the  [Authorize]  attribute in the Global Filter Store, all methods that explicitly use  [AllowAnonymous] User (request) is required to authenticate "not opened" . Since  ReadTokens  callback is executed in the context of the initial  login  request it is safe to believe that the user should see  logged in ? Since the response has not been sent back to the customer, the request is not yet authenticated. 
 
 What is the best way to resolve it? Apart from this, if this is the root cause of the problem then it will be visible only when the production of the system is used? Just check out the query that the clock is right on your production server.