[Blazor] [Authentication] RedirectToLogin from CookieHandler is not working behind a proxy
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 281
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Describe the bug
Redirect to Login: [here]( https://github.com/dotnet/aspnetcore/blob/52364da7f2d8e8956085a92c2f6b9dae48ac130d/src/Security/Authentication/Cookies/src/CookieAuthenticationHandler.cs#L485C22-L485C37) is using Request.Scheme in order to generate the Login URL.
In case we are using a proxy, we will use `UseForwardedHeaders` in order to consider `ForwardedHeaders.XForwardedProto` .
The new blazor template for authentication, doesn't contain `UseAuthorization` and `UseAuthentication` and these middlewares are added automatically during app build. [I think here](https://github.com/dotnet/aspnetcore/blob/52364da7f2d8e8956085a92c2f6b9dae48ac130d/src/DefaultBuilder/src/WebApplicationBuilder.cs#L433)
Any person who is searching about this problem, will find that they need to use `UseForwardedHeaders` but that will only add the middleware after the Authentication and Autorization middlewares are already in the pipeline, so the transformation of the Request.Scheme was not applied yet when redirect to login in happening.
```
var builder = WebApplication.CreateBuilder(args);
// add my services
...
var app = builder.Build();
app.UseForwardedHeaders(new ForwardedHeadersOptions
{
ForwardedHeaders = ForwardedHeaders.XForwardedProto | ForwardedHeaders.XForwardedHost | ForwardedHeaders.XForwardedFor
});
// Use rest of the middlewares
...
app.Run();
```
One solution is to add the `UseAuthorization` and `UseAuthentication` after the forwarded headers:
// Use rest of the middlewares
```
var app = builder.Build();
app.UseForwardedHeaders(new ForwardedHeadersOptions
{
ForwardedHeaders = ForwardedHeaders.XForwardedProto | ForwardedHeaders.XForwardedHost | ForwardedHeaders.XForwardedFor
});
app.UseAuthentication();
app.UseAuthorization();
...
app.Run();
```
This way we ensure that the correct order is applied.
### Expected Behavior
I think the best scenario would be so that automatically added `AuthorizationMiddleware` and `AuthenticationMiddleware` would be added after the `ForwardedHeadersMiddleware` if that was specifically registered, but that is probably quite hard to archive.
The alternative would be at least to update the docs to clearly say that using `UseForwardedHeaders` will require you to specifically add `UseAuthentication` and `UseAuthorization` as those which are automatically registered will not consider forwarded headers.
Also, explicitly adding `UseAuthentication` and `UseAuthorization` to the blazor template with authentication can be considered. In that case, people will add `UseForwardedHeaders` before that.
### Steps To Reproduce
_No response_
### Exceptions (if any)
_No response_
### .NET Version
8.0.100
### Anything else?
_No response_
Contributor guide
Research direction
Start by reading CookieAuthenticationHandler.cs at the linked RedirectToLogin code and WebApplicationBuilder.cs near the linked automatic middleware registration. Compare that ordering with UseForwardedHeaders in the reported proxy setup; done means the forwarded scheme is honored during login redirects, with the chosen fix covered by an appropriate test, template change, or documentation update.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100