Blazor WASM: Silent Logins fail since Chrome 142 on applications hosted in local networks
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 276
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Describe the bug
When running Blazor Apps on private network (192.168.*.*, 172.16.*.*, 10.*.*.*) the OIDC callback during silent authentication is getting blocked with Status: Cross Origin Resource Sharing error: LocalNetworkAccessPermissionDenied
This problem occurs in Chrome 142 and newer due to the newly enabled Feature [Feature: Local network access restrictions](https://chromestatus.com/feature/5152728072060928)
Policy [LocalNetworkAccessAllowedForUrls](https://chromeenterprise.google/policies/#LocalNetworkAccessAllowedForUrls) does not fix the problem.
The guide states: "The LocalNetworkAccessAllowedForUrls policy applies to the top-level origin of the site making the request. If the actual local network access is being made inside of an iframe embedded on that page (or in a nested iframe), [all iframes must set the permissions policy flag](https://docs.google.com/document/d/1QQkqehw8umtAgz5z0um7THx-aoU251p705FbIQjDuGs/edit?tab=t.0#heading=h.denb9idl4lm0)."
### Expected Behavior
Proposed Solution:
Add ability to configure RemoteAuthenticatorView to set the required permission on the iframe, e.g. allow="local-network-access domainB.example domainC.example"
### Steps To Reproduce
- use OIDC Authentication
- run app IP considered private 192.168.*.*, 172.16.*.*, 10.*.*.*
- authenticate
- close and reopen the browser
- monitor the network in developer console (callback gets blocked and user is not authenticated)
-
### Exceptions (if any)
_No response_
### .NET Version
9.0.11
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.