dotnet / dotnet/aspnetcore

RemoteAuthenticatorView ignores ReturnUrl after successful login in Microsoft.Authentication.WebAssembly.Msal 10.0.10

Open
#68,136 2 comments 0 reactions 1 assignee Claimed by @rokonec View on GitHub
area-auth Regression
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 5h
Merged PRs (30d)
276

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

After upgrading from Microsoft.Authentication.WebAssembly.Msal 10.0.7 to 10.0.10, the application no longer redirects users to the specified ReturnUrl after a successful Entra ID sign-in.

Authentication itself succeeds and the user is correctly signed in. The ReturnUrl is stored in sessionStorage before the redirect to Entra ID and is removed when the authentication callback is processed, indicating that the authentication state is successfully restored. However, instead of navigating back to the requested page, the application always redirects to the root route (/).

The same application, configuration, and code work as expected with version 10.0.7.

### Expected Behavior

After a successful authentication using Microsoft Entra ID, RemoteAuthenticatorView should restore the authentication state and redirect the user to the URL specified in InteractiveRequestOptions.ReturnUrl.

### Steps To Reproduce

Authentication is initiated via:

```csharp
Navigation.NavigateToLogin(
Options.Get(Options.DefaultName).AuthenticationPaths.LogInPath,
new InteractiveRequestOptions
{
ReturnUrl = Navigation.Uri,
Interaction = InteractionType.SignIn,
});
```

Router configuration:

```razor


@if (context.User.Identity == null || !context.User.Identity.IsAuthenticated)
{

}

```

Authentication.razor:

```razor
@page "/authentication/{Action}/"
@using Microsoft.AspNetCore.Components.WebAssembly.Authentication
@inject NavigationManager Navigation
@attribute [AllowAnonymous]

@code{
[Parameter] public string? Action { get; set; }


}
```

Additional information

Authentication provider: Microsoft Entra ID
Hosting model: Blazor WebAssembly
Login mode: redirect
Works with:
Microsoft.Authentication.WebAssembly.Msal 10.0.7
Fails with:
Microsoft.Authentication.WebAssembly.Msal 10.0.10
ReturnUrl is correctly captured
No additional login redirect is triggered after sign-in
No authentication errors are reported in the browser console

This appears to be a regression introduced between versions 10.0.7 and 10.0.10.

### Exceptions (if any)

_No response_

### .NET Version

_No response_

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.