dotnet / dotnet/aspnetcore

Blazor InteractiveWebAssembly with BFF

Open
#65,368 6 comments 0 reactions 0 assignees View on GitHub
area-auth Needs: Attention :wave: Needs: Repro
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

**Describe the issue**

We are using Blazor Web App with only `InteractiveWebAssembly` (because of some limitations of external components we use) and we authenticate through OpenIdConnect.
We want to use the BFF pattern as explained in the [documentation](https://learn.microsoft.com/en-us/aspnet/core/blazor/security/blazor-web-app-with-oidc?view=aspnetcore-10.0&pivots=without-yarp-and-aspire).

However, there is no sample for only InteractiveWebAsssembly, so we started with the BlazorWebAppOidcBffAuto sample and removed the `.AddInteractiveServerComponents()`

Locally on our development machines this all seemed to work fine, but once we deploy our application on our Kubernetes cluster we start running into issues.

- The logout (authentication/logout) doesn't work, the page returns a 500:
```
StatusCode: 500, BodyAsText: This form is being accessed with an invalid anti-forgery token. Validate the `IAntiforgeryValidationFeature` on the request before reading from the form.
```
This can be fixed by disabling AntiForgery on the endpoint, but we are not sure if this is correct?
- After x amount of time, it seems like the frontend 'forgets' your authentication. All the [Authorize] attributes return an unauthorized, and getting items from the claims `await AuthenticationStateProvider.GetAuthenticationStateAsync();` returns nothing.

**To Reproduce**

Steps to reproduce the behavior:

1. Adjust the BlazorWebAppOidcBffAuto sample to only be InteractiveWebAssembly.
2. Deploy the application through: `dotnet publish "${PROJECT}.csproj" -c Release -p RuntimeIdentifier=linux-x64`
3. Try to authentication/logout endpoint.

**Additional context**

- DOTNET 10
- Template: https://github.com/dotnet/blazor-samples/tree/main/10.0/BlazorWebAppOidcBffAuto

Is InteractiveWebAssembly not supported with the sample codes, or there any different changes we need to do?

(cc: @guardrex https://github.com/dotnet/blazor-samples/issues/642)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.