Blazor interactive unauthorized .NET 8

Question

I am building a service that uses a mix of SSR and interactive server. The SSR portion is only used to login. Now after the login completes, any request to the backend fails as unauthorized, but if I print the HttpContext on the Blazor page (interactive server), the user is logged in.

Any idea about what is going on?

EDIT CODE:

To make the starting example: create a folder and once inside it run dotnet new mudblazor --interactivity Server --auth Individual

REPLACE: program.cs

using Microsoft.AspNetCore.Components.Authorization;
using Microsoft.AspNetCore.Identity;
using Microsoft.EntityFrameworkCore;
using MudBlazor.Services;
using test2.Components;
using test2.Components.Account;
using test2.Data;

var builder = WebApplication.CreateBuilder(args);

// Add MudBlazor services
builder.Services.AddMudServices();

// Add services to the container.
builder.Services.AddRazorComponents()
    .AddInteractiveServerComponents();

builder.Services.AddCascadingAuthenticationState();
builder.Services.AddScoped();
builder.Services.AddScoped();
builder.Services.AddScoped();

builder.Services.AddScoped(sp => new HttpClient { BaseAddress = new Uri(builder.Configuration["ApiUrl"] ?? "http://localhost:5009/") });

builder.Services.AddAuthentication(options =>
    {
        options.DefaultScheme = IdentityConstants.ApplicationScheme;
        options.DefaultSignInScheme = IdentityConstants.ExternalScheme;
    })
    .AddIdentityCookies();

var connectionString = builder.Configuration.GetConnectionString("DefaultConnection") ?? throw new InvalidOperationException("Connection string 'DefaultConnection' not found.");
builder.Services.AddDbContext(options =>
    options.UseSqlite(connectionString));
builder.Services.AddDatabaseDeveloperPageExceptionFilter();

builder.Services.AddControllers();

builder.Services.AddIdentityCore(options =>
    {
        options.SignIn.RequireConfirmedAccount = false;
        options.Password.RequireDigit = false;
        options.Password.RequireLowercase = false;
        options.Password.RequireNonAlphanumeric = false;
        options.Password.RequireUppercase = false;
        options.Password.RequiredLength = 1;
    })
    .AddEntityFrameworkStores()
    .AddSignInManager()
    .AddDefaultTokenProviders();

builder.Services.AddSingleton, IdentityNoOpEmailSender>();

// Add this after the authentication configuration
builder.Services.AddAuthorization();

var app = builder.Build();

// Configure the HTTP request pipeline.

    app.UseMigrationsEndPoint();



app.UseStaticFiles();
app.UseAntiforgery();
app.UseAuthentication();
app.UseAuthorization();

app.MapRazorComponents()
    .AddInteractiveServerRenderMode();
    
// Add additional endpoints required by the Identity /Account Razor components.
app.MapAdditionalIdentityEndpoints();

app.MapControllers();

app.Run();

NavMenu.razor:

@implements IDisposable

@inject NavigationManager NavigationManager


    Home
    Auth Required
    
        
            test
            debug
        
        
            Register
            Login
        
    



@code {
    private string? currentUrl;

    protected override void OnInitialized()
    {
        currentUrl = NavigationManager.ToBaseRelativePath(NavigationManager.Uri);
        NavigationManager.LocationChanged += OnLocationChanged;
    }

    private void OnLocationChanged(object? sender, LocationChangedEventArgs e)
    {
        currentUrl = NavigationManager.ToBaseRelativePath(e.Location);
        StateHasChanged();
    }

    public void Dispose()
    {
        NavigationManager.LocationChanged -= OnLocationChanged;
    }
}

create a Testcontroller.cs at the same level as Program.cs:

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

[ApiController]
[Route("api/")]
public class TestController : ControllerBase
{
    [HttpGet]
    [Authorize]
    [Route("test")]
    public IActionResult Get()
    {
        return Ok("Hello from the API!");
    }
}

create 2 new files, in the pages folder: testpage.razor:

    @page "/test"
    @inject HttpClient Http
    @inject ISnackbar Snackbar
    
    API Test
    
    
        Get Test Data
    
    
    @if (!string.IsNullOrEmpty(_apiResponse))
    {
        
            @_apiResponse
        
    }
    
    @code {
        private string _apiResponse = string.Empty;
    
        private async Task GetTestData()
        {
            try
            {
                _apiResponse = await Http.GetStringAsync("api/test");
                Snackbar.Add("Data retrieved successfully!", Severity.Success);
            }
            catch (Exception ex)
            {
                Snackbar.Add("Error fetching data: " + ex.Message, Severity.Error);
            }
        }
}

Debug.razor:

@page "/auth-debug"
@using System.Security.Claims
@using Microsoft.AspNetCore.Http
@inject IHttpContextAccessor HttpContextAccessor


    
        
            Authentication Debug Information
        
        
            
                
                    
                        Basic Information
                        
                            
                                Is Authenticated: @IsAuthenticated
                            
                            
                                Auth Type: @AuthType
                            
                            
                                Is Admin: @IsInAdminRole
                            
                        
                    
                

                
                    
                        Authorization Header
                        
                    
                

                
                    
                        Roles
                        @if (Roles.Any())
                        {
                            
                                @foreach (var role in Roles)
                                {
                                    @role
                                }
                            
                        }
                        else
                        {
                            No roles found
                        }
                    
                

                
                    
                        
                            @if (Claims.Any())
                            {
                                
                                    
                                        Type
                                        Value
                                    
                                    
                                        @context.Type
                                        @context.Value
                                    
                                
                            }
                            else
                            {
                                No claims found
                            }
                        
                    
                
            
        
        
            Refresh Data
        
    


@code {
    private bool IsAuthenticated => HttpContextAccessor.HttpContext?.User?.Identity?.IsAuthenticated ?? false;
    private string AuthType => HttpContextAccessor.HttpContext?.User?.Identity?.AuthenticationType ?? "None";
    private string AuthHeader => HttpContextAccessor.HttpContext?.Request.Headers.Authorization.ToString() ?? "None";
    private bool IsInAdminRole => HttpContextAccessor.HttpContext?.User?.IsInRole("Administrator") ?? false;
    private IEnumerable Roles => HttpContextAccessor.HttpContext?.User?.Claims
        .Where(c => c.Type == ClaimTypes.Role)
        .Select(c => c.Value) ?? Array.Empty();
    private IEnumerable Claims => HttpContextAccessor.HttpContext?.User?.Claims
        .Select(c => new ClaimInfo { Type = c.Type, Value = c.Value }) ?? Array.Empty();

    private void RefreshData()
    {
        StateHasChanged();
    }

    private class ClaimInfo
    {
        public string? Type { get; set; }
        public string? Value { get; set; }
    }
}

The request on the testpage fails, and instead returns the text of the login page instead of the test text

Blazor interactive unauthorized .NET 8

Answers (1)

Related Questions