dotnet / dotnet/aspnetcore

Blazor Interactive Server with OIDC

Open
#60,193 0 comments 1 reaction 0 assignees View on GitHub
area-auth investigate
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

Describe the issue

I'm trying to implement Blazor InteractiveServer with Oidc and cookies. Logging in/out and redirecting the loginpage of the IdP works like it's supposed to, no issues there. My issues start with the `CookieOidcRefresher` class.

I have `@attribute [Authorize]` set in `_Imports.razor` to make sure every page needs authorization. For the rest my testproject uses the code of the `BlazorWebAppOidcServer` example.

When i navigate to a different page, the event `OnValidatePrincipal` doesn't trigger. So the tokens/cookies may be expired when i try to use them on the page. I did some tinkering and found that when i put the code `app.MapBlazorHub()` (this line of code is NOT in the example) then the event triggers when i navigate to a different page. However, now none of the buttons on any page work because of the `AmbiguousMatchException` error. Which is documented [here](https://learn.microsoft.com/en-us/aspnet/core/blazor/fundamentals/signalr?view=aspnetcore-8.0#server-side-circuit-handler-options). So i added the `.WithOrder(-1)`. Now the buttons are working again and i have no `AmbiguousMatchException` anymore, however now the `OnValidatePrincipal` event doesn't trigger anymore when i navigate to a different page.

I can work around it by adding a timer in the `CookieOidcRefresher` class. But this feels hacky and i don't think this is the intended way of working.

What am i missing here?

Expected behavior

That the `OnValidatePrincipal` event triggers every time i navigate to a different page.

I created a sample project on [GitHub](https://github.com/gerrewsb/BlazorOidc)
I removed the authority/clientid/clientsecret from the oidc-settings as those are irrelevant to this issue.

cc: @guardrex https://github.com/dotnet/blazor-samples/issues/470

Contributor guide

Open the contributing guide

Research direction

Start with the CookieOidcRefresher class, _Imports.razor authorization attribute, and the app.MapBlazorHub() configuration in the linked BlazorOidc sample. Compare navigation with and without MapBlazorHub and WithOrder(-1), then verify that OnValidatePrincipal runs during navigation without breaking button handlers or requiring the timer workaround.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
authentication, frontend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.