In my project, I use the Identity server OpenId Connect for authorization.

One of the clients of Identity is the MVC type.

For scalability, I need multiple replicas of the client running.

When the number of the client is 1 (only one instance is running), all things are great.

When increase number of client to 2, after deployment when browsing pages that need authorization

1. Redirect to the Identity server (as I expected)
2. After login successful, Identity set cookies in the Identity server domain(as I expected)
3. I have expected that after redirect, MVC client cookies set in the client domain and user authorized, But this exception is thrown:

Exception: Unable to unprotect the message.State.

Unknown location

Exception: An error was encountered while handling the remote login.

MVC client OpenIdConnect settings:

"OpenIdConnect": {
    "ClientId": "mvc",
    "Authority": "https://identity.usw1.kubesail.io/",
    "ClientSecret": "REDACTED",
    "ResponseType": "code",
    "UsePkce": false,
    "GetClaimsFromUserInfoEndpoint": true,
    "SaveTokens": false,
    "RequireHttpsMetadata": false,
    "Scope": [ "openid", "profile" ],
}

Identity server setting for MVC Client

new Client
{
    ClientId = "mvc",
    ClientName = "MVC Client",

    AllowedGrantTypes = GrantTypes.CodeAndClientCredentials,
    RequirePkce = false,
    ClientSecrets = { new Secret("REDACTED".Sha256()) },

    RedirectUris = { "http://mvc.c1.kubesail.io/signin-oidc" },
    FrontChannelLogoutUri = "http://mvc.c1.kubesail.io/signout-oidc",
    PostLogoutRedirectUris = { "http://mvc.c1.kubesail.io/signout-callback-oidc" },
    RequireConsent = false,

    AllowOfflineAccess = true,
    AllowedScopes = { "openid", "profile" }
}

Specification of development and deployment:

Identity server 4

Project types are Asp.net core 3.1

Deployment on Kubernetes