dotnet / dotnet/aspnetcore

Blazor WASM: Silent Logins fail since Chrome 142 on applications hosted in local networks

Open
#64,699 4 comments 0 reactions 1 assignee Claimed by @Youssef1313 View on GitHub
area-auth
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 5h
Merged PRs (30d)
276

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

When running Blazor Apps on private network (192.168.*.*, 172.16.*.*, 10.*.*.*) the OIDC callback during silent authentication is getting blocked with Status: Cross Origin Resource Sharing error: LocalNetworkAccessPermissionDenied

This problem occurs in Chrome 142 and newer due to the newly enabled Feature [Feature: Local network access restrictions](https://chromestatus.com/feature/5152728072060928)

Policy [LocalNetworkAccessAllowedForUrls](https://chromeenterprise.google/policies/#LocalNetworkAccessAllowedForUrls) does not fix the problem.

The guide states: "The LocalNetworkAccessAllowedForUrls policy applies to the top-level origin of the site making the request. If the actual local network access is being made inside of an iframe embedded on that page (or in a nested iframe), [all iframes must set the permissions policy flag](https://docs.google.com/document/d/1QQkqehw8umtAgz5z0um7THx-aoU251p705FbIQjDuGs/edit?tab=t.0#heading=h.denb9idl4lm0)."

### Expected Behavior

Proposed Solution:
Add ability to configure RemoteAuthenticatorView to set the required permission on the iframe, e.g. allow="local-network-access domainB.example domainC.example"

### Steps To Reproduce

- use OIDC Authentication
- run app IP considered private 192.168.*.*, 172.16.*.*, 10.*.*.*
- authenticate
- close and reopen the browser
- monitor the network in developer console (callback gets blocked and user is not authenticated)
-

### Exceptions (if any)

_No response_

### .NET Version

9.0.11

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.