dotnet / dotnet/aspnetcore

[Blazor] [Authentication] RedirectToLogin from CookieHandler is not working behind a proxy

Open
#52,707 0 comments 3 reactions 0 assignees View on GitHub
area-identity Docs
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Describe the bug

Redirect to Login: [here]( https://github.com/dotnet/aspnetcore/blob/52364da7f2d8e8956085a92c2f6b9dae48ac130d/src/Security/Authentication/Cookies/src/CookieAuthenticationHandler.cs#L485C22-L485C37) is using Request.Scheme in order to generate the Login URL.

In case we are using a proxy, we will use `UseForwardedHeaders` in order to consider `ForwardedHeaders.XForwardedProto` .

The new blazor template for authentication, doesn't contain `UseAuthorization` and `UseAuthentication` and these middlewares are added automatically during app build. [I think here](https://github.com/dotnet/aspnetcore/blob/52364da7f2d8e8956085a92c2f6b9dae48ac130d/src/DefaultBuilder/src/WebApplicationBuilder.cs#L433)

Any person who is searching about this problem, will find that they need to use `UseForwardedHeaders` but that will only add the middleware after the Authentication and Autorization middlewares are already in the pipeline, so the transformation of the Request.Scheme was not applied yet when redirect to login in happening.

```

var builder = WebApplication.CreateBuilder(args);

// add my services
...

var app = builder.Build();

app.UseForwardedHeaders(new ForwardedHeadersOptions
{
ForwardedHeaders = ForwardedHeaders.XForwardedProto | ForwardedHeaders.XForwardedHost | ForwardedHeaders.XForwardedFor
});

// Use rest of the middlewares
...

app.Run();

```

One solution is to add the `UseAuthorization` and `UseAuthentication` after the forwarded headers:

// Use rest of the middlewares
```

var app = builder.Build();

app.UseForwardedHeaders(new ForwardedHeadersOptions
{
ForwardedHeaders = ForwardedHeaders.XForwardedProto | ForwardedHeaders.XForwardedHost | ForwardedHeaders.XForwardedFor
});

app.UseAuthentication();
app.UseAuthorization();

...

app.Run();
```

This way we ensure that the correct order is applied.

### Expected Behavior

I think the best scenario would be so that automatically added `AuthorizationMiddleware` and `AuthenticationMiddleware` would be added after the `ForwardedHeadersMiddleware` if that was specifically registered, but that is probably quite hard to archive.

The alternative would be at least to update the docs to clearly say that using `UseForwardedHeaders` will require you to specifically add `UseAuthentication` and `UseAuthorization` as those which are automatically registered will not consider forwarded headers.

Also, explicitly adding `UseAuthentication` and `UseAuthorization` to the blazor template with authentication can be considered. In that case, people will add `UseForwardedHeaders` before that.

### Steps To Reproduce

_No response_

### Exceptions (if any)

_No response_

### .NET Version

8.0.100

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reading CookieAuthenticationHandler.cs at the linked RedirectToLogin code and WebApplicationBuilder.cs near the linked automatic middleware registration. Compare that ordering with UseForwardedHeaders in the reported proxy setup; done means the forwarded scheme is honored during login redirects, with the chosen fix covered by an appropriate test, template change, or documentation update.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.