Update section on passing tokens in Blazor Web Apps #31691

guardrex · 2024-02-05T13:34:04Z

Description

Per our offline discussion, I'll see about implementing Halter's suggestion at Stephen's remarks fleshed out further for this.

Also see #35225.

Here's the LIVE section link that merely tells readers that this content is due to be updated ...

https://learn.microsoft.com/en-us/aspnet/core/blazor/security/server/additional-scenarios?view=aspnetcore-8.0#pass-tokens-to-a-server-side-blazor-app

What we have for Blazor Server is in the 7.0 version of the article ...

https://learn.microsoft.com/en-us/aspnet/core/blazor/security/server/additional-scenarios?view=aspnetcore-7.0#pass-tokens-to-a-server-side-blazor-app

Page URL

https://learn.microsoft.com/en-us/aspnet/core/blazor/security/server/additional-scenarios?view=aspnetcore-8.0

Content source URL

https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/blazor/security/server/additional-scenarios.md

Document ID

c98be365-408d-7ee6-cb74-14c44d01b0b8

Article author

@guardrex

timohermans · 2024-02-06T15:58:23Z

I just found this issue, so I'll just leave my two cents here.

I tried applying this to my own blazor server 8 app. When adding a scoped TokenProvider service, the set value will not be handed over to the circuit. The value will initially be set during the prerender, but on the second oninitializedasync null.

What did work was marking the service as singleton, though I'm not sure if this is the way the documentation intended it to be done.

GStoynev · 2024-02-10T23:55:08Z

#31759 got closed, but let me share what worked for me, if helpful to patch the documentation or to others searching for solution to the issue:

Capturing a cookie inline like this and then passing it as a Parameter to the Routes component where it's stored in the scoped provider seems to do the trick:

<body>
@{
    var cookie = HttpContext?.Request.Cookies["UI"];
    Logger.LogInformation("Cookie captured: {UICookie}", cookie);
}

<Routes Cookie="@cookie" @rendermode="InteractiveServer"/>
<script src="_framework/blazor.web.js"></script>

</body>

GStoynev · 2024-02-11T00:00:23Z

Another suggestion for that section of the documentation:

Mixing OpenIdConnect in the example creates the impression that there might be some magic happening there, that alleviates the issue with the pre-rendering and the duplicated TokenProvider.

A simple example with a cookie would have been simpler and to the point.

timohermans · 2024-02-15T07:42:10Z

@GStoynev wow that is a very easy solution 🤔.

One other thing I found out yesterday is that the httpcontext is always available within a HttpClient implementation, wherever you inject it inside the circuit. Which is also what the documentation does, I believe.

guardrex · 2024-02-15T12:25:49Z

The product unit (PU) is working through their backlog to reach this issue and take a look at the section. I hope we'll have this sorted out no later than the end of next week (2/23).

guardrex · 2024-02-23T23:26:48Z

Still trying to get 👁️👁️ on this. I'll try to reach out to Stephen and Jeremy again on Monday.

guardrex · 2024-02-27T17:53:37Z

~~I was just made aware over on a PU issue of the following approach in an Javier sample app ...~~

~~https://github.com/javiercn/BlazorWebNonceService/~~

~~I'll take a look at that to resolve this issue ... hopefully within a couple of days.~~

No 🎲🎲 .... That only addresses the nonce situation. Also, that sample doesn't match the approach that Stephen adopted for the BWA on dotnet/blazor-samples#240.

Kumima · 2024-09-12T05:56:04Z

@pmi24
For InteractiveServer, HttpContext can actually be accessible without that approach, such as using IHttpContextAccessor. But I think that HttpContext is something like readonly. The reason why you meet the problem is SignInManager.SignInAsync() needs to set the cookie which needs to write the HttpContext. So, the login page in the default template is rendered as static.

Blazor authentication is really a complicated topic, especially now we have the Auto mode. I've notice there are many issues raised to discuss what's the best approach, I hope the documentation will keep improving this.

huazhb · 2024-11-30T10:18:25Z

@pmi24 For InteractiveServer, HttpContext can actually be accessible without that approach, such as using IHttpContextAccessor. But I think that HttpContext is something like readonly. The reason why you meet the problem is SignInManager.SignInAsync() needs to set the cookie which needs to write the HttpContext. So, the login page in the default template is rendered as static.

Blazor authentication is really a complicated topic, especially now we have the Auto mode. I've notice there are many issues raised to discuss what's the best approach, I hope the documentation will keep improving this.

Finally, I found someone noted InteractiveServer does valid for HttpContext and IHttpContextAccessor. The Microsoft website really confusion which state "IHttpContextAccessor]must be avoided with interactive rendering because there isn't a valid HttpContext available.". I think only the code that run at the client side will NOT valid for HttpContext like InteractiveClient or InteractiveAuto that after first initialization.

nicholasyin · 2025-04-01T00:27:07Z

@pmi24 For InteractiveServer, HttpContext can actually be accessible without that approach, such as using IHttpContextAccessor. But I think that HttpContext is something like readonly. The reason why you meet the problem is SignInManager.SignInAsync() needs to set the cookie which needs to write the HttpContext. So, the login page in the default template is rendered as static.
Blazor authentication is really a complicated topic, especially now we have the Auto mode. I've notice there are many issues raised to discuss what's the best approach, I hope the documentation will keep improving this.

Finally, I found someone noted InteractiveServer does valid for HttpContext and IHttpContextAccessor. The Microsoft website really confusion which state "IHttpContextAccessor]must be avoided with interactive rendering because there isn't a valid HttpContext available.". I think only the code that run at the client side will NOT valid for HttpContext like InteractiveClient or InteractiveAuto that after first initialization.

Yes, by means of debugging I see that the same code gets run twice, in SSR. The first time HttpContext has value while in the second time it's null. So all in all, 'should be avoided' is correct.

guardrex · 2025-04-27T12:08:19Z

The sample app consists of two projects:

Update to "three projects."

guardrex added Source - Docs.ms Docs Customer feedback via GitHub Issue ⌚ Not Triaged labels Feb 5, 2024

dotnet-bot added aspnet-core/svc blazor/subsvc labels Feb 5, 2024

github-project-automation bot added this to Blazor.Docs Feb 5, 2024

github-project-automation bot moved this to Triage in Blazor.Docs Feb 5, 2024

github-actions bot added the Blazor label Feb 5, 2024

github-actions bot assigned guardrex Feb 5, 2024

github-actions bot removed the ⌚ Not Triaged label Feb 5, 2024

dotnet deleted a comment from github-actions bot Feb 5, 2024

guardrex assigned halter73 and JeremyLikness Feb 5, 2024

This was referenced Feb 5, 2024

Blazor .NET 8 tracking issue #28161

Closed

Blazor 8.0 offline discussion updates #31688

Closed

guardrex added Pri1 doc-enhancement labels Feb 5, 2024

guardrex moved this from Triage to 8.0 in Blazor.Docs Feb 5, 2024

guardrex removed the Source - Docs.ms Docs Customer feedback via GitHub Issue label Feb 5, 2024

guardrex mentioned this issue Feb 5, 2024

Offline discussion updates for 8.0 #31693

Merged

guardrex mentioned this issue Feb 10, 2024

https://learn.microsoft.com/en-us/aspnet/core/blazor/security/server/additional-scenarios?view=aspnetcore-8.0#pass-tokens-to-a-server-side-blazor-app #31759

Closed

guardrex mentioned this issue Feb 23, 2024

Cookie example does not work for .Net 8 template because the state container does not instantiate in user scope #31899

Closed

guardrex unassigned halter73 and JeremyLikness Feb 27, 2024

guardrex moved this from 8.0 to P0/P1 - High Priority in Blazor.Docs Dec 6, 2024

guardrex removed the 8.0 .NET 8 label Dec 6, 2024

guardrex mentioned this issue Dec 11, 2024

Update the passing tokens section #34336

Merged

guardrex moved this from P0/P1 - High Priority to 10.0 in Blazor.Docs Dec 11, 2024

guardrex added the 10.0 .NET 10 label Dec 11, 2024

KevinDockx mentioned this issue Mar 3, 2025

Update for .Net 9 ETA ? KevinDockx/AuthNZinBlazor#2

Open

guardrex mentioned this issue Mar 10, 2025

Add BWA + web API coverage and sample app #34927

Closed

guardrex moved this from 10.0 to P0/P1 - High Priority in Blazor.Docs Mar 15, 2025

guardrex removed the 10.0 .NET 10 label Mar 15, 2025

guardrex moved this from P0/P1 - High Priority to In progress in Blazor.Docs Mar 25, 2025

guardrex moved this from In progress to P0/P1 - High Priority in Blazor.Docs Mar 25, 2025

This was referenced Mar 27, 2025

BlazorWebAppOidcServer: How to get access_token to pass to API? dotnet/blazor-samples#500

Closed

Update the passing tokens guidance #35067

Merged

This was referenced Apr 15, 2025

Add documentation for JWT authentication in Blazor #35225

Open

Passing token approach BWA+OIDC Server solution dotnet/blazor-samples#513

Merged

Remove insecure endpoint dotnet/blazor-samples#514

Merged

This was referenced Apr 22, 2025

Passing tokens in interactive BWAs #35286

Merged

Add web API to BWA+Entra sample app dotnet/blazor-samples#515

Merged

guardrex moved this from P0/P1 - High Priority to In progress in Blazor.Docs Apr 24, 2025

This was referenced Apr 24, 2025

MS Id Web Downstream API package for Entra+BFF dotnet/blazor-samples#516

Merged

Update BWA+Entra app settings dotnet/blazor-samples#518

Merged

Update BWA+OIDC BFF app config dotnet/blazor-samples#519

Merged

typo: three not two #35312

Closed

This was referenced Apr 28, 2025

Add call web API to BWA+OIDC samples dotnet/blazor-samples#526

Merged

Follow-up security web API work #35317

Merged

guardrex linked a pull request May 16, 2025 that will close this issue

Add the latest recommended passing tokens approach #35482

Draft

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update section on passing tokens in Blazor Web Apps #31691

Update section on passing tokens in Blazor Web Apps #31691

guardrex commented Feb 5, 2024 •

edited

Loading

timohermans commented Feb 6, 2024 •

edited

Loading

GStoynev commented Feb 10, 2024

GStoynev commented Feb 11, 2024

timohermans commented Feb 15, 2024 •

edited

Loading

guardrex commented Feb 15, 2024

guardrex commented Feb 23, 2024 •

edited

Loading

guardrex commented Feb 27, 2024 •

edited

Loading

Kumima commented Sep 12, 2024

huazhb commented Nov 30, 2024

nicholasyin commented Apr 1, 2025

guardrex commented Apr 27, 2025

Update section on passing tokens in Blazor Web Apps #31691

Update section on passing tokens in Blazor Web Apps #31691

Comments

guardrex commented Feb 5, 2024 • edited Loading

Description

Page URL

Content source URL

Document ID

Article author

timohermans commented Feb 6, 2024 • edited Loading

GStoynev commented Feb 10, 2024

GStoynev commented Feb 11, 2024

timohermans commented Feb 15, 2024 • edited Loading

guardrex commented Feb 15, 2024

guardrex commented Feb 23, 2024 • edited Loading

guardrex commented Feb 27, 2024 • edited Loading

Kumima commented Sep 12, 2024

huazhb commented Nov 30, 2024

nicholasyin commented Apr 1, 2025

guardrex commented Apr 27, 2025

guardrex commented Feb 5, 2024 •

edited

Loading

timohermans commented Feb 6, 2024 •

edited

Loading

timohermans commented Feb 15, 2024 •

edited

Loading

guardrex commented Feb 23, 2024 •

edited

Loading

guardrex commented Feb 27, 2024 •

edited

Loading