coronag

Found a possible response : state could be the issue. Not stored (session/cookie) or even passed to vk or even in the redirected uri. With multiple connect at the same...

It seems that giving "state" param to VK "authorize" request resolve my issue. Vk is giving it back to the redirect uri, perfect.

If you want to see with lines of code : https://github.com/sociabble/Duke.Owin.VkontakteMiddleware/commit/4cfacc320e35bd889e4262af57c407dd5ec9340a