From 93cae2c8b272da2f2161daa2b4eb5e4fb3d12779 Mon Sep 17 00:00:00 2001
From: Luke Latham <1622880+guardrex@users.noreply.github.com>
Date: Mon, 13 Apr 2020 19:25:25 -0500
Subject: [PATCH 1/8] Scaffolding into Blazor Server apps

Updates

Updates

Updates

Update aspnetcore/includes/scaffold-identity/id-scaffold-dlg-auth.md

Co-Authored-By: Rick Anderson <3605364+Rick-Anderson@users.noreply.github.com>

Remove dup Identity code in Startup

Use the relative path for Login redirect

Login redirect requires the force flag

Surface a Identity pages styling approach
---
 aspnetcore/includes/scaffold-identity/hsts.md |   2 +-
 .../scaffold-identity/id-scaffold-dlg-auth.md |  34 ++-
 .../scaffold-identity/id-scaffold-dlg.md      |  17 +-
 .../authentication/scaffold-identity.md       | 245 ++++++++++++++++--
 .../3.1sample/StartupBlazor.cs                |  36 +++
 .../scaffold-identity/3.1sample/StartupMVC.cs |   5 -
 .../scaffold-identity/3.1sample/StartupRP.cs  |   6 -
 aspnetcore/security/blazor/index.md           |  58 +++--
 aspnetcore/security/blazor/server.md          | 108 ++++++--
 9 files changed, 404 insertions(+), 107 deletions(-)
 create mode 100644 aspnetcore/security/authentication/scaffold-identity/3.1sample/StartupBlazor.cs

diff --git a/aspnetcore/includes/scaffold-identity/hsts.md b/aspnetcore/includes/scaffold-identity/hsts.md
index 50963294d274..359c0000fbbb 100644
--- a/aspnetcore/includes/scaffold-identity/hsts.md
+++ b/aspnetcore/includes/scaffold-identity/hsts.md
@@ -1 +1 @@
-`UseHsts` is recommended but not required. See [HTTP Strict Transport Security Protocol](xref:security/enforcing-ssl#http-strict-transport-security-protocol-hsts) for more information.
+`UseHsts` is recommended but not required. For more information, see [HTTP Strict Transport Security Protocol](xref:security/enforcing-ssl#http-strict-transport-security-protocol-hsts).
diff --git a/aspnetcore/includes/scaffold-identity/id-scaffold-dlg-auth.md b/aspnetcore/includes/scaffold-identity/id-scaffold-dlg-auth.md
index 22038acb216f..71a57d6ff018 100644
--- a/aspnetcore/includes/scaffold-identity/id-scaffold-dlg-auth.md
+++ b/aspnetcore/includes/scaffold-identity/id-scaffold-dlg-auth.md
@@ -7,16 +7,14 @@ Run the Identity scaffolder:
 * From **Solution Explorer**, right-click on the project > **Add** > **New Scaffolded Item**.
 * From the left pane of the **Add Scaffold** dialog, select **Identity** > **Add**.
 * In the **Add Identity** dialog, select the options you want.
-  * Select your existing layout page, or your layout file will be overwritten with incorrect markup. When an existing *\_Layout.cshtml* file is selected, it is **not** overwritten.
-
- For example:
-  `~/Pages/Shared/_Layout.cshtml` for Razor Pages
-  `~/Views/Shared/_Layout.cshtml` for MVC projects
+  * Select your existing layout page so your layout file isn't overwritten with incorrect markup. When an existing *\_Layout.cshtml* file is selected, it is **not** overwritten. For example:
+    * `~/Pages/Shared/_Layout.cshtml` for Razor Pages or Blazor Server projects with existing Razor Pages infrastructure
+    * `~/Views/Shared/_Layout.cshtml` for MVC projects or Blazor Server projects with existing MVC infrastructure
 * To use your existing data context, select at least one file to override. You must select at least one file to add your data context.
   * Select your data context class.
   * Select **Add**.
 * To create a new user context and possibly create a custom user class for Identity:
-  * Select the **+** button to create a new **Data context class**.
+  * Select the **+** button to create a new **Data context class**. Accept the default value or specify a class (for example, `MyApplication.Data.ApplicationDbContext`).
   * Select **Add**.
 
 Note: If you're creating a new user context, you don't have to select a file to override.
@@ -29,7 +27,7 @@ If you have not previously installed the ASP.NET Core scaffolder, install it now
 dotnet tool install -g dotnet-aspnet-codegenerator
 ```
 
-Add required NuGet package references to the project (\*.csproj) file. Run the following command in the project directory:
+Add required NuGet package references to the project file (*.csproj*). Run the following commands in the project directory:
 
 ```dotnetcli
 dotnet add package Microsoft.VisualStudio.Web.CodeGeneration.Design
@@ -51,13 +49,13 @@ dotnet aspnet-codegenerator identity -h
 In the project folder, run the Identity scaffolder with the options you want. For example, to setup identity with the default UI and the minimum number of files, run the following command. Use the correct fully qualified name for your DB context:
 
 ```dotnetcli
-dotnet aspnet-codegenerator identity -dc MyWeb.Data.ApplicationDbContext --files "Account.Register;Account.Login"
+dotnet aspnet-codegenerator identity -dc MyApplication.Data.ApplicationDbContext --files "Account.Register;Account.Login"
 ```
 
 PowerShell uses semicolon as a command separator. When using PowerShell, escape the semi-colons in the file list or put the file list in double quotes. For example:
 
 ```dotnetcli
-dotnet aspnet-codegenerator identity -dc MyWeb.Data.ApplicationDbContext --files "Account.Register;Account.Login;Account.Logout"
+dotnet aspnet-codegenerator identity -dc MyApplication.Data.ApplicationDbContext --files "Account.Register;Account.Login;Account.Logout"
 ```
 
 If you run the Identity scaffolder without specifying the `--files` flag or the `--useDefaultUI` flag, all the available Identity UI pages will be created in your project.
@@ -75,16 +73,14 @@ Run the Identity scaffolder:
 * From **Solution Explorer**, right-click on the project > **Add** > **New Scaffolded Item**.
 * From the left pane of the **Add Scaffold** dialog, select **Identity** > **Add**.
 * In the **Add Identity** dialog, select the options you want.
-  * Select your existing layout page, or your layout file will be overwritten with incorrect markup. When an existing *\_Layout.cshtml* file is selected, it is **not** overwritten.
-
- For example:
-  `~/Pages/Shared/_Layout.cshtml` for Razor Pages
-  `~/Views/Shared/_Layout.cshtml` for MVC projects
+  * Select your existing layout page, or your layout file will be overwritten with incorrect markup. When an existing *\_Layout.cshtml* file is selected, it is **not** overwritten. For example:
+    * `~/Pages/Shared/_Layout.cshtml` for Razor Pages
+    * `~/Views/Shared/_Layout.cshtml` for MVC projects
 * To use your existing data context, select at least one file to override. You must select at least one file to add your data context.
   * Select your data context class.
   * Select **Add**.
 * To create a new user context and possibly create a custom user class for Identity:
-  * Select the **+** button to create a new **Data context class**.
+  * Select the **+** button to create a new **Data context class**. Accept the default value or specify a class (for example, `MyApplication.Data.ApplicationDbContext`).
   * Select **Add**.
 
 Note: If you're creating a new user context, you don't have to select a file to override.
@@ -97,7 +93,7 @@ If you have not previously installed the ASP.NET Core scaffolder, install it now
 dotnet tool install -g dotnet-aspnet-codegenerator
 ```
 
-Add a package reference to [Microsoft.VisualStudio.Web.CodeGeneration.Design](https://www.nuget.org/packages/Microsoft.VisualStudio.Web.CodeGeneration.Design/) to the project (\*.csproj) file. Run the following command in the project directory:
+Add a package reference to [Microsoft.VisualStudio.Web.CodeGeneration.Design](https://www.nuget.org/packages/Microsoft.VisualStudio.Web.CodeGeneration.Design/) to the project file (*.csproj*). Run the following commands in the project directory:
 
 ```dotnetcli
 dotnet add package Microsoft.VisualStudio.Web.CodeGeneration.Design
@@ -113,17 +109,17 @@ dotnet aspnet-codegenerator identity -h
 In the project folder, run the Identity scaffolder with the options you want. For example, to setup identity with the default UI and the minimum number of files, run the following command. Use the correct fully qualified name for your DB context:
 
 ```dotnetcli
-dotnet aspnet-codegenerator identity -dc MyWeb.Data.ApplicationDbContext --files "Account.Register;Account.Login"
+dotnet aspnet-codegenerator identity -dc MyApplication.Data.ApplicationDbContext --files "Account.Register;Account.Login"
 ```
 
 PowerShell uses semicolon as a command separator. When using PowerShell, escape the semi-colons in the file list or put the file list in double quotes. For example:
 
 ```dotnetcli
-dotnet aspnet-codegenerator identity -dc MyWeb.Data.ApplicationDbContext --files "Account.Register;Account.Login;Account.Logout"
+dotnet aspnet-codegenerator identity -dc MyApplication.Data.ApplicationDbContext --files "Account.Register;Account.Login;Account.Logout"
 ```
 
 If you run the Identity scaffolder without specifying the `--files` flag or the `--useDefaultUI` flag, all the available Identity UI pages will be created in your project.
 
 ---
 
-::: moniker-end
\ No newline at end of file
+::: moniker-end
diff --git a/aspnetcore/includes/scaffold-identity/id-scaffold-dlg.md b/aspnetcore/includes/scaffold-identity/id-scaffold-dlg.md
index 012eee95e0b9..d8de890ca753 100644
--- a/aspnetcore/includes/scaffold-identity/id-scaffold-dlg.md
+++ b/aspnetcore/includes/scaffold-identity/id-scaffold-dlg.md
@@ -3,13 +3,14 @@ Run the Identity scaffolder:
 # [Visual Studio](#tab/visual-studio)
 
 * From **Solution Explorer**, right-click on the project > **Add** > **New Scaffolded Item**.
-* From the left pane of the **Add Scaffold** dialog, select **Identity** > **ADD**.
-* In the **ADD Identity** dialog, select the options you want.
-  * Select your existing layout page, or your layout file will be overwritten with incorrect markup. For example
-  `~/Pages/Shared/_Layout.cshtml` for Razor Pages
-  `~/Views/Shared/_Layout.cshtml` for MVC projects
-  * Select the **+** button to create a new **Data context class**.
-* Select **ADD**.
+* From the left pane of the **Add New Scaffolded Item** dialog, select **Identity** > **Add**.
+* In the **Add Identity** dialog, select the options you want.
+  * Select your existing layout page, or your layout file will be overwritten with incorrect markup:
+    * `~/Pages/Shared/_Layout.cshtml` for Razor Pages
+    * `~/Views/Shared/_Layout.cshtml` for MVC projects
+    * Blazor Server apps created from the Blazor Server template (`blazorserver`) aren't configured for Razor Pages or MVC by default. Leave the layout page entry blank.
+  * Select the **+** button to create a new **Data context class**. Accept the default value or specify a class (for example, `MyApplication.Data.ApplicationDbContext`).
+* Select **Add**.
 
 # [.NET Core CLI](#tab/netcore-cli)
 
@@ -19,7 +20,7 @@ If you have not previously installed the ASP.NET Core scaffolder, install it now
 dotnet tool install -g dotnet-aspnet-codegenerator
 ```
 
-Add required NuGet package references to the project (\*.csproj) file. Run the following command in the project directory:
+Add required NuGet package references to the project file (*.csproj*). Run the following commands in the project directory:
 
 ```dotnetcli
 dotnet add package Microsoft.VisualStudio.Web.CodeGeneration.Design
diff --git a/aspnetcore/security/authentication/scaffold-identity.md b/aspnetcore/security/authentication/scaffold-identity.md
index 9df19e607356..7b85c594fe5a 100644
--- a/aspnetcore/security/authentication/scaffold-identity.md
+++ b/aspnetcore/security/authentication/scaffold-identity.md
@@ -5,7 +5,7 @@ description: Learn how to scaffold Identity in an ASP.NET Core project.
 monikerRange: '>= aspnetcore-2.1'
 ms.author: riande
 ms.custom: mvc
-ms.date: 01/15/2020
+ms.date: 04/21/2020
 uid: security/authentication/scaffold-identity
 ---
 # Scaffold Identity in ASP.NET Core projects
@@ -14,7 +14,7 @@ By [Rick Anderson](https://twitter.com/RickAndMSFT)
 
 ::: moniker range=">= aspnetcore-3.0"
 
-ASP.NET Core provides [ASP.NET Core Identity](xref:security/authentication/identity) as a [Razor Class Library](xref:razor-pages/ui-class). Applications that include Identity can apply the scaffolder to selectively add the source code contained in the Identity Razor Class Library (RCL). You might want to generate source code so you can modify the code and change the behavior. For example, you could instruct the scaffolder to generate the code used in registration. Generated code takes precedence over the same code in the Identity RCL. To gain full control of the UI and not use the default RCL, see the section [Create full identity UI source](#full).
+ASP.NET Core provides [ASP.NET Core Identity](xref:security/authentication/identity) as a [Razor Class Library](xref:razor-pages/ui-class). Applications that include Identity can apply the scaffolder to selectively add the source code contained in the Identity Razor Class Library (RCL). You might want to generate source code so you can modify the code and change the behavior. For example, you could instruct the scaffolder to generate the code used in registration. Generated code takes precedence over the same code in the Identity RCL. To gain full control of the UI and not use the default RCL, see the section [Create full Identity UI source](#full).
 
 Applications that do **not** include authentication can apply the scaffolder to add the RCL Identity package. You have the option of selecting Identity code to be generated.
 
@@ -26,7 +26,7 @@ Services are required when using [Two Factor Authentication](xref:security/authe
 
 This document contains more complete instructions than the *ScaffoldingReadme.txt* file which is generated when running the scaffolder.
 
-## Scaffold identity into an empty project
+## Scaffold Identity into an empty project
 
 [!INCLUDE[](~/includes/scaffold-identity/id-scaffold-dlg.md)]
 
@@ -38,7 +38,7 @@ Update the `Startup` class with code similar to the following:
 
 [!INCLUDE[](~/includes/scaffold-identity/migrations.md)]
 
-## Scaffold identity into a Razor project without existing authorization
+## Scaffold Identity into a Razor project without existing authorization
 
 <!--  Updated for 3.0
 set projNam=RPnoAuth
@@ -67,7 +67,7 @@ before dotnet ef database update
 
 [!INCLUDE[](~/includes/scaffold-identity/id-scaffold-dlg.md)]
 
-Identity is configured in *Areas/Identity/IdentityHostingStartup.cs*. for more information, see [IHostingStartup](xref:fundamentals/configuration/platform-specific-configuration).
+Identity is configured in *Areas/Identity/IdentityHostingStartup.cs*. For more information, see [IHostingStartup](xref:fundamentals/configuration/platform-specific-configuration).
 
 <a name="efm"></a>
 
@@ -89,9 +89,9 @@ Update the `Startup` class with code similar to the following:
 
 Optional: Add the login partial (`_LoginPartial`) to the layout file:
 
-[!code-html[Main](scaffold-identity/3.1sample/_Layout.cshtml?highlight=20)]
+[!code-html[](scaffold-identity/3.1sample/_Layout.cshtml?highlight=20)]
 
-## Scaffold identity into a Razor project with authorization
+## Scaffold Identity into a Razor project with authorization
 
 <!--
 Use >=2.1: dotnet new webapp -au Individual -o RPauth
@@ -105,9 +105,10 @@ dotnet aspnet-codegenerator identity -dc RPauth.Data.ApplicationDbContext --file
 -->
 
 [!INCLUDE[](~/includes/scaffold-identity/id-scaffold-dlg-auth.md)]
+
 Some Identity options are configured in *Areas/Identity/IdentityHostingStartup.cs*. For more information, see [IHostingStartup](xref:fundamentals/configuration/platform-specific-configuration).
 
-## Scaffold identity into an MVC project without existing authorization
+## Scaffold Identity into an MVC project without existing authorization
 
 <!--
 set projNam=MvcNoAuth
@@ -127,7 +128,7 @@ dotnet ef database update
 
 Optional: Add the login partial (`_LoginPartial`) to the *Views/Shared/_Layout.cshtml* file:
 
-[!code-html[Main](scaffold-identity/3.1sample/_Layout.cshtml?highlight=20)]
+[!code-html[](scaffold-identity/3.1sample/_Layout.cshtml?highlight=20)]
 
 * Move the *Pages/Shared/_LoginPartial.cshtml* file to *Views/Shared/_LoginPartial.cshtml*
 
@@ -141,7 +142,7 @@ Update the `Startup` class with code similar to the following:
 
 [!INCLUDE[](~/includes/scaffold-identity/hsts.md)]
 
-## Scaffold identity into an MVC project with authorization
+## Scaffold Identity into an MVC project with authorization
 
 <!--
 dotnet new mvc -au Individual -o MvcAuth
@@ -153,9 +154,212 @@ dotnet aspnet-codegenerator identity -dc MvcAuth.Data.ApplicationDbContext  --fi
 
 [!INCLUDE[](~/includes/scaffold-identity/id-scaffold-dlg-auth.md)]
 
+## Scaffold Identity into a Blazor Server project without existing authorization
+
+[!INCLUDE[](~/includes/scaffold-identity/id-scaffold-dlg.md)]
+
+Identity is configured in *Areas/Identity/IdentityHostingStartup.cs*. For more information, see [IHostingStartup](xref:fundamentals/configuration/platform-specific-configuration).
+
+### Migrations
+
+[!INCLUDE[](~/includes/scaffold-identity/migrations.md)]
+
+### Pass tokens to the app
+
+Tokens can be passed to components:
+
+* When authentication tokens are provisioned and saved to the authentication cookie, they can be passed to components.
+* Razor components can't use `HttpContext` directly, so there's no way to obtain an [anti-request forgery (XSRF) token](xref:security/anti-request-forgery) to POST to Identity's logout endpoint at `/Identity/Account/Logout`. An XSRF token can be passed to components.
+
+For more information and example code, see <xref:security/blazor/server#pass-tokens>. The `TokenProvider` service demonstrated in the topic is used in the `LoginDisplay` component in the following [Layout and authentication flow changes](#layout-and-authentication-flow-changes) section.
+
+### Enable authentication
+
+In the `Startup` class:
+
+* Confirm that Razor Pages services are added in `Startup.ConfigureServices`.
+* If using the [TokenProvider](xref:security/blazor/server#pass-tokens), register the service.
+* Call `UseDatabaseErrorPage` on the application builder in `Startup.Configure` for the Development environment.
+* Call `UseAuthentication` and `UseAuthorization` after `UseRouting`.
+* Add an endpoint for Razor Pages.
+
+[!code-csharp[](scaffold-identity/3.1sample/StartupBlazor.cs?highlight=3,6,14,27-28,32)]
+
+[!INCLUDE[](~/includes/scaffold-identity/hsts.md)]
+
+### Layout and authentication flow changes
+
+Add a `RedirectToLogin` component (*RedirectToLogin.razor*) to the app's *Shared* folder in the project root:
+
+```razor
+@inject NavigationManager Navigation
+@code {
+    protected override void OnInitialized()
+    {
+        Navigation.NavigateTo("Identity/Account/Login?returnUrl=" +
+            Navigation.ToBaseRelativePath(Navigation.Uri), true);
+    }
+}
+```
+
+Add a `LoginDisplay` component (*LoginDisplay.razor*) to the app's *Shared* folder. The [TokenProvider service](xref:security/blazor/server#pass-tokens) provides the XSRF token for the HTML form that POSTs to Identity's logout endpoint:
+
+```razor
+@using Microsoft.AspNetCore.Components.Authorization
+@inject NavigationManager Navigation
+@inject TokenProvider TokenProvider
+
+<AuthorizeView>
+    <Authorized>
+        <a href="Identity/Account/Manage/Index">
+            Hello, @context.User.Identity.Name!
+        </a>
+        <form action="/Identity/Account/Logout?returnUrl=%2F" method="post">
+            <button class="nav-link btn btn-link" type="submit">Logout</button>
+            <input name="__RequestVerificationToken" type="hidden" 
+                value="@TokenProvider.XsrfToken">
+        </form>
+    </Authorized>
+    <NotAuthorized>
+        <a href="Identity/Account/Register">Register</a>
+        <a href="Identity/Account/Login">Login</a>
+    </NotAuthorized>
+</AuthorizeView>
+```
+
+In the `MainLayout` component (*Shared/MainLayout.razor*), add the `LoginDisplay` component to the top-row `<div>` element's content:
+
+```razor
+<div class="top-row px-4 auth">
+    <LoginDisplay />
+    <a href="https://docs.microsoft.com/aspnet/" target="_blank">About</a>
+</div>
+```
+
+In the `App` component (*App.razor*):
+
+* Wrap the `Router` component with the `CascadingAuthenticationState` component.
+* Add the `RedirectToLogin` component for unauthorized routes.
+
+The following shows the complete component if the app is also using the [TokenProvider service](xref:security/blazor/server#pass-tokens):
+
+```razor
+@inject TokenProvider TokenProvider
+
+<CascadingAuthenticationState>
+    <Router AppAssembly="@typeof(Program).Assembly">
+        <Found Context="routeData">
+            <AuthorizeRouteView RouteData="@routeData"
+                                DefaultLayout="@typeof(MainLayout)">
+                <NotAuthorized>
+                    <RedirectToLogin />
+                </NotAuthorized>
+            </AuthorizeRouteView>
+        </Found>
+        <NotFound>
+            <LayoutView Layout="@typeof(MainLayout)">
+                <p>Sorry, there's nothing at this address.</p>
+            </LayoutView>
+        </NotFound>
+    </Router>
+</CascadingAuthenticationState>
+
+@code {
+    [Parameter]
+    public InitialApplicationState InitialState { get; set; }
+
+    protected override Task OnInitializedAsync()
+    {
+        TokenProvider.AccessToken = InitialState.AccessToken;
+        TokenProvider.RefreshToken = InitialState.RefreshToken;
+        TokenProvider.XsrfToken = InitialState.XsrfToken;
+
+        return base.OnInitializedAsync();
+    }
+}
+```
+
+### Style authentication endpoints
+
+Because Blazor Server uses Razor Pages Identity pages, the styling of the UI changes when a visitor navigates between Identity pages and components. You have two options to address the incongruous styles:
+
+#### Build Identity components
+
+An approach to using components for Identity instead of pages is to build Identity components. Because `SignInManager` and `UserManager` aren't supported in Razor components, use API endpoints in the Blazor Server app to process user account actions.
+
+#### Use a custom layout with Blazor app styles
+
+The Identity pages layout and styles can be modified to produce pages that use the default Blazor theme.
+
+> [!NOTE]
+> The example in this section is merely a starting point for customization. Additional work is likely required for the best user experience.
+
+Create a new `NavMenu_IdentityLayout` component (*Shared/NavMenu_IdentityLayout.razor*). For the markup and code of the component, use the same content of the app's `NavMenu` component (*Shared/NavMenu.razor*). Strip out any `NavLink`s to components that can't be reached anonymously because automatic redirects in the `RedirectToLogin` component fail for components requiring authentication or authorization.
+
+In the *Pages/Shared/Layout.cshtml* file, make the following changes:
+
+* Add Razor directives to the top of the file to use Tag Helpers and the app's components in the *Shared* folder:
+
+  ```cshtml
+  @addTagHelper *, Microsoft.AspNetCore.Mvc.TagHelpers
+  @using {APPLICATION ASSEMBLY}.Shared
+  ```
+
+  Replace `{APPLICATION ASSEMBLY}` with the app's assembly name.
+
+* Add a `<base>` tag and Blazor stylesheet `<link>` to the `<head>` content:
+
+  ```cshtml
+  <base href="~/" />
+  <link rel="stylesheet" href="~/css/site.css" />
+  ```
+
+* Change the content of the `<body>` tag to the following:
+
+  ```cshtml
+  <div class="sidebar" style="float:left">
+      <component type="typeof(NavMenu_IdentityLayout)" render-mode="ServerPrerendered" />
+  </div>
+
+  <div class="main" style="padding-left:250px">
+      <div class="top-row px-4">
+          @{
+              var result = Engine.FindView(ViewContext, "_LoginPartial", isMainPage: false);
+          }
+          @if (result.Success)
+          {
+              await Html.RenderPartialAsync("_LoginPartial");
+          }
+          else
+          {
+              throw new InvalidOperationException("The default Identity UI layout requires a partial view '_LoginPartial' " +
+                  "usually located at '/Pages/_LoginPartial' or at '/Views/Shared/_LoginPartial' to work. Based on your configuration " +
+                  $"we have looked at it in the following locations: {System.Environment.NewLine}{string.Join(System.Environment.NewLine, result.SearchedLocations)}.");
+          }
+          <a href="https://docs.microsoft.com/aspnet/" target="_blank">About</a>
+      </div>
+
+      <div class="content px-4">
+          @RenderBody()
+      </div>
+  </div>
+
+  <script src="~/Identity/lib/jquery/dist/jquery.min.js"></script>
+  <script src="~/Identity/lib/bootstrap/dist/js/bootstrap.bundle.min.js"></script>
+  <script src="~/Identity/js/site.js" asp-append-version="true"></script>
+  @RenderSection("Scripts", required: false)
+  <script src="_framework/blazor.server.js"></script>
+  ```
+
+## Scaffold Identity into a Blazor Server project with authorization
+
+[!INCLUDE[](~/includes/scaffold-identity/id-scaffold-dlg-auth.md)]
+
+Some Identity options are configured in *Areas/Identity/IdentityHostingStartup.cs*. For more information, see [IHostingStartup](xref:fundamentals/configuration/platform-specific-configuration).
+
 <a name="full"></a>
 
-## Create full identity UI source
+## Create full Identity UI source
 
 To maintain full control of the Identity UI, run the Identity scaffolder and select **Override all files**.
 
@@ -276,7 +480,7 @@ We recommend using a source control system that shows file differences and allow
 > [!NOTE]
 > Services are required when using [Two Factor Authentication](xref:security/authentication/identity-enable-qrcodes), [Account confirmation and password recovery](xref:security/authentication/accconfirm), and other security features with Identity. Services or service stubs aren't generated when scaffolding Identity. Services to enable these features must be added manually. For example, see [Require Email Confirmation](xref:security/authentication/accconfirm#require-email-confirmation).
 
-## Scaffold identity into an empty project
+## Scaffold Identity into an empty project
 
 [!INCLUDE[](~/includes/scaffold-identity/id-scaffold-dlg.md)]
 
@@ -288,7 +492,7 @@ Add the following highlighted calls to the `Startup` class:
 
 [!INCLUDE[](~/includes/scaffold-identity/migrations.md)]
 
-## Scaffold identity into a Razor project without existing authorization
+## Scaffold Identity into a Razor project without existing authorization
 
 <!--  Updated for 3.0
 set projNam=RPnoAuth
@@ -309,7 +513,7 @@ dotnet ef database update
 
 [!INCLUDE[](~/includes/scaffold-identity/id-scaffold-dlg.md)]
 
-Identity is configured in *Areas/Identity/IdentityHostingStartup.cs*. for more information, see [IHostingStartup](xref:fundamentals/configuration/platform-specific-configuration).
+Identity is configured in *Areas/Identity/IdentityHostingStartup.cs*. For more information, see [IHostingStartup](xref:fundamentals/configuration/platform-specific-configuration).
 
 <a name="efm"></a>
 
@@ -331,9 +535,9 @@ In the `Configure` method of the `Startup` class, call [UseAuthentication](/dotn
 
 Optional: Add the login partial (`_LoginPartial`) to the layout file:
 
-[!code-html[Main](scaffold-identity/sample/_Layout.cshtml?highlight=37)]
+[!code-html[](scaffold-identity/sample/_Layout.cshtml?highlight=37)]
 
-## Scaffold identity into a Razor project with authorization
+## Scaffold Identity into a Razor project with authorization
 
 <!--
 Use >=2.1: dotnet new webapp -au Individual -o RPauth
@@ -347,9 +551,10 @@ dotnet aspnet-codegenerator identity -dc RPauth.Data.ApplicationDbContext --file
 -->
 
 [!INCLUDE[](~/includes/scaffold-identity/id-scaffold-dlg-auth.md)]
+
 Some Identity options are configured in *Areas/Identity/IdentityHostingStartup.cs*. For more information, see [IHostingStartup](xref:fundamentals/configuration/platform-specific-configuration).
 
-## Scaffold identity into an MVC project without existing authorization
+## Scaffold Identity into an MVC project without existing authorization
 
 <!--
 set projNam=MvcNoAuth
@@ -383,7 +588,7 @@ Call [UseAuthentication](/dotnet/api/microsoft.aspnetcore.builder.authappbuilder
 
 [!INCLUDE[](~/includes/scaffold-identity/hsts.md)]
 
-## Scaffold identity into an MVC project with authorization
+## Scaffold Identity into an MVC project with authorization
 
 <!--
 dotnet new mvc -au Individual -o MvcAuth
@@ -399,7 +604,7 @@ Delete the *Pages/Shared* folder and the files in that folder.
 
 <a name="full"></a>
 
-## Create full identity UI source
+## Create full Identity UI source
 
 To maintain full control of the Identity UI, run the Identity scaffolder and select **Override all files**.
 
@@ -499,4 +704,4 @@ A similar approach can be followed for production scenarios.
 
 * [Changes to authentication code to ASP.NET Core 2.1 and later](xref:migration/20_21#changes-to-authentication-code)
 
-::: moniker-end
\ No newline at end of file
+::: moniker-end
diff --git a/aspnetcore/security/authentication/scaffold-identity/3.1sample/StartupBlazor.cs b/aspnetcore/security/authentication/scaffold-identity/3.1sample/StartupBlazor.cs
new file mode 100644
index 000000000000..7dcc22788af0
--- /dev/null
+++ b/aspnetcore/security/authentication/scaffold-identity/3.1sample/StartupBlazor.cs
@@ -0,0 +1,36 @@
+public void ConfigureServices(IServiceCollection services)
+{
+    services.AddRazorPages();
+    services.AddServerSideBlazor();
+    services.AddSingleton<WeatherForecastService>();
+    services.AddScoped<TokenProvider>();
+}
+
+public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
+{
+    if (env.IsDevelopment())
+    {
+        app.UseDeveloperExceptionPage();
+        app.UseDatabaseErrorPage();
+    }
+    else
+    {
+        app.UseExceptionHandler("/Error");
+        app.UseHsts();
+    }
+
+    app.UseHttpsRedirection();
+    app.UseStaticFiles();
+
+    app.UseRouting();
+
+    app.UseAuthentication();
+    app.UseAuthorization();
+
+    app.UseEndpoints(endpoints =>
+    {
+        endpoints.MapRazorPages();
+        endpoints.MapBlazorHub();
+        endpoints.MapFallbackToPage("/_Host");
+    });
+}
diff --git a/aspnetcore/security/authentication/scaffold-identity/3.1sample/StartupMVC.cs b/aspnetcore/security/authentication/scaffold-identity/3.1sample/StartupMVC.cs
index 3920e8f74ef8..c5c11317001e 100644
--- a/aspnetcore/security/authentication/scaffold-identity/3.1sample/StartupMVC.cs
+++ b/aspnetcore/security/authentication/scaffold-identity/3.1sample/StartupMVC.cs
@@ -27,11 +27,6 @@ public Startup(IConfiguration configuration)
 
         public void ConfigureServices(IServiceCollection services)
         {
-            services.AddDbContext<ApplicationDbContext>(options =>
-                options.UseSqlServer(
-                    Configuration.GetConnectionString("DefaultConnection")));
-            services.AddDefaultIdentity<IdentityUser>(options => options.SignIn.RequireConfirmedAccount = true)
-                .AddEntityFrameworkStores<ApplicationDbContext>();
             services.AddControllersWithViews();
             services.AddRazorPages();
         }
diff --git a/aspnetcore/security/authentication/scaffold-identity/3.1sample/StartupRP.cs b/aspnetcore/security/authentication/scaffold-identity/3.1sample/StartupRP.cs
index 9b4605d23b2a..8ac884d9dd43 100644
--- a/aspnetcore/security/authentication/scaffold-identity/3.1sample/StartupRP.cs
+++ b/aspnetcore/security/authentication/scaffold-identity/3.1sample/StartupRP.cs
@@ -21,12 +21,6 @@ public Startup(IConfiguration configuration)
 
         public void ConfigureServices(IServiceCollection services)
         {
-            services.AddDbContext<ApplicationDbContext>(options =>
-                options.UseSqlServer(
-                    Configuration.GetConnectionString("DefaultConnection")));
-            services.AddDefaultIdentity<IdentityUser>(options => 
-                                                      options.SignIn.RequireConfirmedAccount = true)
-                .AddEntityFrameworkStores<ApplicationDbContext>();
             services.AddRazorPages();
         }
 
diff --git a/aspnetcore/security/blazor/index.md b/aspnetcore/security/blazor/index.md
index 7b17ceddbbae..666eb7b0a831 100644
--- a/aspnetcore/security/blazor/index.md
+++ b/aspnetcore/security/blazor/index.md
@@ -204,18 +204,19 @@ If `user.Identity.IsAuthenticated` is `true`, claims can be enumerated and membe
 Set up the `Task<AuthenticationState>` cascading parameter using the `AuthorizeRouteView` and `CascadingAuthenticationState` components in the `App` component (*App.razor*):
 
 ```razor
-<Router AppAssembly="@typeof(Program).Assembly">
-    <Found Context="routeData">
-        <AuthorizeRouteView RouteData="@routeData" DefaultLayout="@typeof(MainLayout)" />
-    </Found>
-    <NotFound>
-        <CascadingAuthenticationState>
+<CascadingAuthenticationState>
+    <Router AppAssembly="@typeof(Program).Assembly">
+        <Found Context="routeData">
+            <AuthorizeRouteView RouteData="@routeData" 
+                DefaultLayout="@typeof(MainLayout)" />
+        </Found>
+        <NotFound>
             <LayoutView Layout="@typeof(MainLayout)">
                 <p>Sorry, there's nothing at this address.</p>
             </LayoutView>
-        </CascadingAuthenticationState>
-    </NotFound>
-</Router>
+        </NotFound>
+    </Router>
+</CascadingAuthenticationState>
 ```
 
 In a Blazor WebAssembly App, add services for options and authorization to `Program.Main`:
@@ -376,29 +377,30 @@ The `Router` component, in conjunction with the `AuthorizeRouteView` component,
 In the default Blazor Server project template, the `App` component (*App.razor*) demonstrates how to set custom content:
 
 ```razor
-<Router AppAssembly="@typeof(Program).Assembly">
-    <Found Context="routeData">
-        <AuthorizeRouteView RouteData="@routeData" DefaultLayout="@typeof(MainLayout)">
-            <NotAuthorized>
-                <h1>Sorry</h1>
-                <p>You're not authorized to reach this page.</p>
-                <p>You may need to log in as a different user.</p>
-            </NotAuthorized>
-            <Authorizing>
-                <h1>Authentication in progress</h1>
-                <p>Only visible while authentication is in progress.</p>
-            </Authorizing>
-        </AuthorizeRouteView>
-    </Found>
-    <NotFound>
-        <CascadingAuthenticationState>
+<CascadingAuthenticationState>
+    <Router AppAssembly="@typeof(Program).Assembly">
+        <Found Context="routeData">
+            <AuthorizeRouteView RouteData="@routeData" 
+                DefaultLayout="@typeof(MainLayout)">
+                <NotAuthorized>
+                    <h1>Sorry</h1>
+                    <p>You're not authorized to reach this page.</p>
+                    <p>You may need to log in as a different user.</p>
+                </NotAuthorized>
+                <Authorizing>
+                    <h1>Authentication in progress</h1>
+                    <p>Only visible while authentication is in progress.</p>
+                </Authorizing>
+            </AuthorizeRouteView>
+        </Found>
+        <NotFound>
             <LayoutView Layout="@typeof(MainLayout)">
                 <h1>Sorry</h1>
                 <p>Sorry, there's nothing at this address.</p>
             </LayoutView>
-        </CascadingAuthenticationState>
-    </NotFound>
-</Router>
+        </NotFound>
+    </Router>
+</CascadingAuthenticationState>
 ```
 
 The content of `<NotFound>`, `<NotAuthorized>`, and `<Authorizing>` tags can include arbitrary items, such as other interactive components.
diff --git a/aspnetcore/security/blazor/server.md b/aspnetcore/security/blazor/server.md
index 58e870ecd736..39e4e54ad88d 100644
--- a/aspnetcore/security/blazor/server.md
+++ b/aspnetcore/security/blazor/server.md
@@ -5,7 +5,7 @@ description: Learn how to mitigate security threats to Blazor Server apps.
 monikerRange: '>= aspnetcore-3.1'
 ms.author: riande
 ms.custom: mvc
-ms.date: 04/02/2020
+ms.date: 04/13/2020
 no-loc: [Blazor, SignalR]
 uid: security/blazor/server
 ---
@@ -95,9 +95,20 @@ The command creates a folder named with the value provided for the `{APP NAME}`
 
 ---
 
-## Pass tokens to a Blazor Server app
+## Scaffold Identity
 
-Authenticate the Blazor Server app as you would with a regular Razor Pages or MVC app. Provision and save the tokens to the authentication cookie. For example:
+To scaffold Idenity into a Blazor Server project, see the following articles:
+
+* [Scaffold Identity into a Blazor Server project without existing authorization](xref:security/authentication/scaffold-identity#scaffold-identity-into-a-blazor-server-project-without-existing-authorization)
+* [Scaffold Identity into a Blazor Server project with authorization](xref:security/authentication/scaffold-identity#scaffold-identity-into-a-blazor-server-project-with-authorization)
+
+## Pass tokens
+
+Authentication tokens that are only available outside of Razor components can be passed to components by implementing a token provider.
+
+Other types of tokens can also be passed to a Blazor Server app. For example, [anti-request forgery (XSRF) tokens](xref:security/anti-request-forgery) can be passed to components that POST to Identity's logout endpoint at `/Identity/Account/Logout`.
+
+To pass authentication tokens, authenticate the Blazor Server app as you would with a regular Razor Pages or MVC app. Provision and save the tokens to the authentication cookie:
 
 ```csharp
 using Microsoft.AspNetCore.Authentication.OpenIdConnect;
@@ -117,33 +128,33 @@ services.Configure<OpenIdConnectOptions>(AzureADDefaults.OpenIdScheme, options =
 
 For sample code, including a complete `Startup.ConfigureServices` example, see the [Passing tokens to a server-side Blazor application](https://github.com/javiercn/blazor-server-aad-sample).
 
-Define a class to pass in the initial app state with the access and refresh tokens:
+To provide an XSRF token and authentication tokens to any component that requires them, adopt the following pattern.
+
+Define a class to pass in the initial app state with the access, refresh, and XSRF tokens:
 
 ```csharp
 public class InitialApplicationState
 {
     public string AccessToken { get; set; }
     public string RefreshToken { get; set; }
+    public string XsrfToken { get; set; }
 }
 ```
 
 Define a **scoped** token provider service that can be used within the Blazor app to resolve the tokens from DI:
 
 ```csharp
-using System;
-using System.Security.Claims;
-using System.Threading.Tasks;
-
 public class TokenProvider
 {
     public string AccessToken { get; set; }
     public string RefreshToken { get; set; }
+    public string XsrfToken { get; set; }
 }
 ```
 
 In `Startup.ConfigureServices`, add services for:
 
-* `IHttpClientFactory`
+* `IHttpClientFactory` &ndash; Only required if the app makes HTTP requests, which is usually the case for apps that use access and refresh tokens.
 * `TokenProvider`
 
 ```csharp
@@ -151,10 +162,11 @@ services.AddHttpClient();
 services.AddScoped<TokenProvider>();
 ```
 
-In the *_Host.cshtml* file, create and instance of `InitialApplicationState` and pass it as a parameter to the app:
+In the *Pages/_Host.cshtml* file, create an instance of `InitialApplicationState` with token values and pass it as a parameter to the app:
 
 ```cshtml
 @using Microsoft.AspNetCore.Authentication
+@inject Microsoft.AspNetCore.Antiforgery.IAntiforgery Xsrf
 
 ...
 
@@ -162,7 +174,8 @@ In the *_Host.cshtml* file, create and instance of `InitialApplicationState` and
     var tokens = new InitialApplicationState
     {
         AccessToken = await HttpContext.GetTokenAsync("access_token"),
-        RefreshToken = await HttpContext.GetTokenAsync("refresh_token")
+        RefreshToken = await HttpContext.GetTokenAsync("refresh_token"),
+        XsrfToken = Xsrf.GetAndStoreTokens(HttpContext).RequestToken
     };
 }
 
@@ -175,9 +188,25 @@ In the *_Host.cshtml* file, create and instance of `InitialApplicationState` and
 In the `App` component (*App.razor*), resolve the service and initialize it with the data from the parameter:
 
 ```razor
-@inject TokenProvider TokensProvider
-
-...
+@inject TokenProvider TokenProvider
+
+<CascadingAuthenticationState>
+    <Router AppAssembly="@typeof(Program).Assembly">
+        <Found Context="routeData">
+            <AuthorizeRouteView RouteData="@routeData"
+                                DefaultLayout="@typeof(MainLayout)">
+                <NotAuthorized>
+                    <RedirectToLogin />
+                </NotAuthorized>
+            </AuthorizeRouteView>
+        </Found>
+        <NotFound>
+            <LayoutView Layout="@typeof(MainLayout)">
+                <p>Sorry, there's nothing at this address.</p>
+            </LayoutView>
+        </NotFound>
+    </Router>
+</CascadingAuthenticationState>
 
 @code {
     [Parameter]
@@ -185,36 +214,50 @@ In the `App` component (*App.razor*), resolve the service and initialize it with
 
     protected override Task OnInitializedAsync()
     {
-        TokensProvider.AccessToken = InitialState.AccessToken;
-        TokensProvider.RefreshToken = InitialState.RefreshToken;
+        TokenProvider.AccessToken = InitialState.AccessToken;
+        TokenProvider.RefreshToken = InitialState.RefreshToken;
+        TokenProvider.XsrfToken = InitialState.XsrfToken;
 
         return base.OnInitializedAsync();
     }
 }
 ```
 
+The `RedirectToLogin` component in the app's *Shared* folder handles redirecting unauthorized users to the login page of an app with ASP.NET Core Identity:
+
+```razor
+@inject NavigationManager Navigation
+@code {
+    protected override void OnInitialized()
+    {
+        Navigation.NavigateTo("Identity/Account/Login?returnUrl=" +
+            Navigation.ToBaseRelativePath(Navigation.Uri), true);
+    }
+}
+```
+
 In the service that makes a secure API request, inject the token provider and retrieve the token to call the API:
 
 ```csharp
 public class WeatherForecastService
 {
-    private readonly TokenProvider _store;
+    private readonly TokenProvider _tokenProvider;
 
     public WeatherForecastService(IHttpClientFactory clientFactory, 
         TokenProvider tokenProvider)
     {
         Client = clientFactory.CreateClient();
-        _store = tokenProvider;
+        _tokenProvider = tokenProvider;
     }
 
     public HttpClient Client { get; }
 
     public async Task<WeatherForecast[]> GetForecastAsync(DateTime startDate)
     {
-        var token = _store.AccessToken;
         var request = new HttpRequestMessage(HttpMethod.Get, 
             "https://localhost:5003/WeatherForecast");
-        request.Headers.Add("Authorization", $"Bearer {token}");
+        request.Headers.Add(
+            "Authorization", $"Bearer {_tokenProvider.AccessToken}");
         var response = await Client.SendAsync(request);
         response.EnsureSuccessStatusCode();
 
@@ -223,6 +266,31 @@ public class WeatherForecastService
 }
 ```
 
+A Razor component can request the `TokenProvider` service and obtain the XSRF token for an HTML form. In the following example, the logout HTML form includes the XSRF token (`__RequestVerificationToken`) from the `TokenProvider` when the form is submitted:
+
+```razor
+@using Microsoft.AspNetCore.Components.Authorization
+@inject TokenProvider TokenProvider
+@inject NavigationManager Navigation
+
+<AuthorizeView>
+    <Authorized>
+        <a href="Identity/Account/Manage/Index">
+            Hello, @context.User.Identity.Name!
+        </a>
+        <form action="/Identity/Account/Logout?returnUrl=%2F" method="post">
+            <button class="nav-link btn btn-link" type="submit">Logout</button>
+            <input name="__RequestVerificationToken" type="hidden" 
+                value="@TokenProvider.XsrfToken">
+        </form>
+    </Authorized>
+    <NotAuthorized>
+        <a href="Identity/Account/Register">Register</a>
+        <a href="Identity/Account/Login">Login</a>
+    </NotAuthorized>
+</AuthorizeView>
+```
+
 ## Resource exhaustion
 
 Resource exhaustion can occur when a client interacts with the server and causes the server to consume excessive resources. Excessive resource consumption primarily affects:

From 4c2b13f2de84b0d126920311d22d78eaaf70fb7c Mon Sep 17 00:00:00 2001
From: Luke Latham <1622880+guardrex@users.noreply.github.com>
Date: Tue, 21 Apr 2020 12:06:57 -0500
Subject: [PATCH 2/8] Shorten code lines

---
 .../security/authentication/scaffold-identity.md      | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/aspnetcore/security/authentication/scaffold-identity.md b/aspnetcore/security/authentication/scaffold-identity.md
index 7b85c594fe5a..c7de9edeaa99 100644
--- a/aspnetcore/security/authentication/scaffold-identity.md
+++ b/aspnetcore/security/authentication/scaffold-identity.md
@@ -318,13 +318,15 @@ In the *Pages/Shared/Layout.cshtml* file, make the following changes:
 
   ```cshtml
   <div class="sidebar" style="float:left">
-      <component type="typeof(NavMenu_IdentityLayout)" render-mode="ServerPrerendered" />
+      <component type="typeof(NavMenu_IdentityLayout)" 
+          render-mode="ServerPrerendered" />
   </div>
 
   <div class="main" style="padding-left:250px">
       <div class="top-row px-4">
           @{
-              var result = Engine.FindView(ViewContext, "_LoginPartial", isMainPage: false);
+              var result = Engine.FindView(ViewContext, "_LoginPartial", 
+                  isMainPage: false);
           }
           @if (result.Success)
           {
@@ -332,9 +334,8 @@ In the *Pages/Shared/Layout.cshtml* file, make the following changes:
           }
           else
           {
-              throw new InvalidOperationException("The default Identity UI layout requires a partial view '_LoginPartial' " +
-                  "usually located at '/Pages/_LoginPartial' or at '/Views/Shared/_LoginPartial' to work. Based on your configuration " +
-                  $"we have looked at it in the following locations: {System.Environment.NewLine}{string.Join(System.Environment.NewLine, result.SearchedLocations)}.");
+              throw new InvalidOperationException("The default Identity UI " +
+                  "layout requires a partial view '_LoginPartial'.");
           }
           <a href="https://docs.microsoft.com/aspnet/" target="_blank">About</a>
       </div>

From bd8a941347a9980518d76f6e0512931391db96d8 Mon Sep 17 00:00:00 2001
From: Luke Latham <1622880+guardrex@users.noreply.github.com>
Date: Thu, 23 Apr 2020 15:22:31 -0500
Subject: [PATCH 3/8] Revert Blazor Server security topic changes

---
 .../authentication/scaffold-identity.md       | 23 +++--
 aspnetcore/security/blazor/server.md          | 88 ++++---------------
 2 files changed, 37 insertions(+), 74 deletions(-)

diff --git a/aspnetcore/security/authentication/scaffold-identity.md b/aspnetcore/security/authentication/scaffold-identity.md
index c7de9edeaa99..b4e5dc682a48 100644
--- a/aspnetcore/security/authentication/scaffold-identity.md
+++ b/aspnetcore/security/authentication/scaffold-identity.md
@@ -164,21 +164,34 @@ Identity is configured in *Areas/Identity/IdentityHostingStartup.cs*. For more i
 
 [!INCLUDE[](~/includes/scaffold-identity/migrations.md)]
 
-### Pass tokens to the app
+### Pass an XSRF token to the app
 
 Tokens can be passed to components:
 
 * When authentication tokens are provisioned and saved to the authentication cookie, they can be passed to components.
 * Razor components can't use `HttpContext` directly, so there's no way to obtain an [anti-request forgery (XSRF) token](xref:security/anti-request-forgery) to POST to Identity's logout endpoint at `/Identity/Account/Logout`. An XSRF token can be passed to components.
 
-For more information and example code, see <xref:security/blazor/server#pass-tokens>. The `TokenProvider` service demonstrated in the topic is used in the `LoginDisplay` component in the following [Layout and authentication flow changes](#layout-and-authentication-flow-changes) section.
+For more information, see <xref:security/blazor/server#pass-tokens-to-a-blazor-server-app>.
+
+In the *Pages/_Host.cshtml* file, establish the token after adding it to the `InitialApplicationState` and `TokenProvider` classes:
+
+```csharp
+var tokens = new InitialApplicationState
+{
+    ...
+
+    XsrfToken = Xsrf.GetAndStoreTokens(HttpContext).RequestToken
+};
+```
+
+The `TokenProvider` service demonstrated in the topic is used in the `LoginDisplay` component in the following [Layout and authentication flow changes](#layout-and-authentication-flow-changes) section.
 
 ### Enable authentication
 
 In the `Startup` class:
 
 * Confirm that Razor Pages services are added in `Startup.ConfigureServices`.
-* If using the [TokenProvider](xref:security/blazor/server#pass-tokens), register the service.
+* If using the [TokenProvider](xref:security/blazor/server#pass-tokens-to-a-blazor-server-app), register the service.
 * Call `UseDatabaseErrorPage` on the application builder in `Startup.Configure` for the Development environment.
 * Call `UseAuthentication` and `UseAuthorization` after `UseRouting`.
 * Add an endpoint for Razor Pages.
@@ -202,7 +215,7 @@ Add a `RedirectToLogin` component (*RedirectToLogin.razor*) to the app's *Shared
 }
 ```
 
-Add a `LoginDisplay` component (*LoginDisplay.razor*) to the app's *Shared* folder. The [TokenProvider service](xref:security/blazor/server#pass-tokens) provides the XSRF token for the HTML form that POSTs to Identity's logout endpoint:
+Add a `LoginDisplay` component (*LoginDisplay.razor*) to the app's *Shared* folder. The [TokenProvider service](xref:security/blazor/server#pass-tokens-to-a-blazor-server-app) provides the XSRF token for the HTML form that POSTs to Identity's logout endpoint:
 
 ```razor
 @using Microsoft.AspNetCore.Components.Authorization
@@ -241,7 +254,7 @@ In the `App` component (*App.razor*):
 * Wrap the `Router` component with the `CascadingAuthenticationState` component.
 * Add the `RedirectToLogin` component for unauthorized routes.
 
-The following shows the complete component if the app is also using the [TokenProvider service](xref:security/blazor/server#pass-tokens):
+The following shows the complete component if the app is also using the [TokenProvider service](xref:security/blazor/server#pass-tokens-to-a-blazor-server-app):
 
 ```razor
 @inject TokenProvider TokenProvider
diff --git a/aspnetcore/security/blazor/server.md b/aspnetcore/security/blazor/server.md
index 39e4e54ad88d..8028c74b2ff5 100644
--- a/aspnetcore/security/blazor/server.md
+++ b/aspnetcore/security/blazor/server.md
@@ -95,20 +95,9 @@ The command creates a folder named with the value provided for the `{APP NAME}`
 
 ---
 
-## Scaffold Identity
+## Pass tokens to a Blazor Server app
 
-To scaffold Idenity into a Blazor Server project, see the following articles:
-
-* [Scaffold Identity into a Blazor Server project without existing authorization](xref:security/authentication/scaffold-identity#scaffold-identity-into-a-blazor-server-project-without-existing-authorization)
-* [Scaffold Identity into a Blazor Server project with authorization](xref:security/authentication/scaffold-identity#scaffold-identity-into-a-blazor-server-project-with-authorization)
-
-## Pass tokens
-
-Authentication tokens that are only available outside of Razor components can be passed to components by implementing a token provider.
-
-Other types of tokens can also be passed to a Blazor Server app. For example, [anti-request forgery (XSRF) tokens](xref:security/anti-request-forgery) can be passed to components that POST to Identity's logout endpoint at `/Identity/Account/Logout`.
-
-To pass authentication tokens, authenticate the Blazor Server app as you would with a regular Razor Pages or MVC app. Provision and save the tokens to the authentication cookie:
+Authenticate the Blazor Server app as you would with a regular Razor Pages or MVC app. Provision and save the tokens to the authentication cookie. For example:
 
 ```csharp
 using Microsoft.AspNetCore.Authentication.OpenIdConnect;
@@ -128,33 +117,33 @@ services.Configure<OpenIdConnectOptions>(AzureADDefaults.OpenIdScheme, options =
 
 For sample code, including a complete `Startup.ConfigureServices` example, see the [Passing tokens to a server-side Blazor application](https://github.com/javiercn/blazor-server-aad-sample).
 
-To provide an XSRF token and authentication tokens to any component that requires them, adopt the following pattern.
-
-Define a class to pass in the initial app state with the access, refresh, and XSRF tokens:
+Define a class to pass in the initial app state with the access and refresh tokens:
 
 ```csharp
 public class InitialApplicationState
 {
     public string AccessToken { get; set; }
     public string RefreshToken { get; set; }
-    public string XsrfToken { get; set; }
 }
 ```
 
 Define a **scoped** token provider service that can be used within the Blazor app to resolve the tokens from DI:
 
 ```csharp
+using System;
+using System.Security.Claims;
+using System.Threading.Tasks;
+
 public class TokenProvider
 {
     public string AccessToken { get; set; }
     public string RefreshToken { get; set; }
-    public string XsrfToken { get; set; }
 }
 ```
 
 In `Startup.ConfigureServices`, add services for:
 
-* `IHttpClientFactory` &ndash; Only required if the app makes HTTP requests, which is usually the case for apps that use access and refresh tokens.
+* `IHttpClientFactory`
 * `TokenProvider`
 
 ```csharp
@@ -162,11 +151,10 @@ services.AddHttpClient();
 services.AddScoped<TokenProvider>();
 ```
 
-In the *Pages/_Host.cshtml* file, create an instance of `InitialApplicationState` with token values and pass it as a parameter to the app:
+In the *_Host.cshtml* file, create and instance of `InitialApplicationState` and pass it as a parameter to the app:
 
 ```cshtml
 @using Microsoft.AspNetCore.Authentication
-@inject Microsoft.AspNetCore.Antiforgery.IAntiforgery Xsrf
 
 ...
 
@@ -174,8 +162,7 @@ In the *Pages/_Host.cshtml* file, create an instance of `InitialApplicationState
     var tokens = new InitialApplicationState
     {
         AccessToken = await HttpContext.GetTokenAsync("access_token"),
-        RefreshToken = await HttpContext.GetTokenAsync("refresh_token"),
-        XsrfToken = Xsrf.GetAndStoreTokens(HttpContext).RequestToken
+        RefreshToken = await HttpContext.GetTokenAsync("refresh_token")
     };
 }
 
@@ -188,7 +175,9 @@ In the *Pages/_Host.cshtml* file, create an instance of `InitialApplicationState
 In the `App` component (*App.razor*), resolve the service and initialize it with the data from the parameter:
 
 ```razor
-@inject TokenProvider TokenProvider
+@inject TokenProvider TokensProvider
+
+...
 
 <CascadingAuthenticationState>
     <Router AppAssembly="@typeof(Program).Assembly">
@@ -214,50 +203,36 @@ In the `App` component (*App.razor*), resolve the service and initialize it with
 
     protected override Task OnInitializedAsync()
     {
-        TokenProvider.AccessToken = InitialState.AccessToken;
-        TokenProvider.RefreshToken = InitialState.RefreshToken;
-        TokenProvider.XsrfToken = InitialState.XsrfToken;
+        TokensProvider.AccessToken = InitialState.AccessToken;
+        TokensProvider.RefreshToken = InitialState.RefreshToken;
 
         return base.OnInitializedAsync();
     }
 }
 ```
 
-The `RedirectToLogin` component in the app's *Shared* folder handles redirecting unauthorized users to the login page of an app with ASP.NET Core Identity:
-
-```razor
-@inject NavigationManager Navigation
-@code {
-    protected override void OnInitialized()
-    {
-        Navigation.NavigateTo("Identity/Account/Login?returnUrl=" +
-            Navigation.ToBaseRelativePath(Navigation.Uri), true);
-    }
-}
-```
-
 In the service that makes a secure API request, inject the token provider and retrieve the token to call the API:
 
 ```csharp
 public class WeatherForecastService
 {
-    private readonly TokenProvider _tokenProvider;
+    private readonly TokenProvider _store;
 
     public WeatherForecastService(IHttpClientFactory clientFactory, 
         TokenProvider tokenProvider)
     {
         Client = clientFactory.CreateClient();
-        _tokenProvider = tokenProvider;
+        _store = tokenProvider;
     }
 
     public HttpClient Client { get; }
 
     public async Task<WeatherForecast[]> GetForecastAsync(DateTime startDate)
     {
+        var token = _store.AccessToken;
         var request = new HttpRequestMessage(HttpMethod.Get, 
             "https://localhost:5003/WeatherForecast");
-        request.Headers.Add(
-            "Authorization", $"Bearer {_tokenProvider.AccessToken}");
+        request.Headers.Add("Authorization", $"Bearer {token}");
         var response = await Client.SendAsync(request);
         response.EnsureSuccessStatusCode();
 
@@ -266,31 +241,6 @@ public class WeatherForecastService
 }
 ```
 
-A Razor component can request the `TokenProvider` service and obtain the XSRF token for an HTML form. In the following example, the logout HTML form includes the XSRF token (`__RequestVerificationToken`) from the `TokenProvider` when the form is submitted:
-
-```razor
-@using Microsoft.AspNetCore.Components.Authorization
-@inject TokenProvider TokenProvider
-@inject NavigationManager Navigation
-
-<AuthorizeView>
-    <Authorized>
-        <a href="Identity/Account/Manage/Index">
-            Hello, @context.User.Identity.Name!
-        </a>
-        <form action="/Identity/Account/Logout?returnUrl=%2F" method="post">
-            <button class="nav-link btn btn-link" type="submit">Logout</button>
-            <input name="__RequestVerificationToken" type="hidden" 
-                value="@TokenProvider.XsrfToken">
-        </form>
-    </Authorized>
-    <NotAuthorized>
-        <a href="Identity/Account/Register">Register</a>
-        <a href="Identity/Account/Login">Login</a>
-    </NotAuthorized>
-</AuthorizeView>
-```
-
 ## Resource exhaustion
 
 Resource exhaustion can occur when a client interacts with the server and causes the server to consume excessive resources. Excessive resource consumption primarily affects:

From 01417796a942ba07bd5a0041ba75bbdc9c301501 Mon Sep 17 00:00:00 2001
From: Luke Latham <1622880+guardrex@users.noreply.github.com>
Date: Thu, 23 Apr 2020 15:24:17 -0500
Subject: [PATCH 4/8] Update

---
 aspnetcore/security/blazor/server.md | 20 +-------------------
 1 file changed, 1 insertion(+), 19 deletions(-)

diff --git a/aspnetcore/security/blazor/server.md b/aspnetcore/security/blazor/server.md
index 8028c74b2ff5..58e870ecd736 100644
--- a/aspnetcore/security/blazor/server.md
+++ b/aspnetcore/security/blazor/server.md
@@ -5,7 +5,7 @@ description: Learn how to mitigate security threats to Blazor Server apps.
 monikerRange: '>= aspnetcore-3.1'
 ms.author: riande
 ms.custom: mvc
-ms.date: 04/13/2020
+ms.date: 04/02/2020
 no-loc: [Blazor, SignalR]
 uid: security/blazor/server
 ---
@@ -179,24 +179,6 @@ In the `App` component (*App.razor*), resolve the service and initialize it with
 
 ...
 
-<CascadingAuthenticationState>
-    <Router AppAssembly="@typeof(Program).Assembly">
-        <Found Context="routeData">
-            <AuthorizeRouteView RouteData="@routeData"
-                                DefaultLayout="@typeof(MainLayout)">
-                <NotAuthorized>
-                    <RedirectToLogin />
-                </NotAuthorized>
-            </AuthorizeRouteView>
-        </Found>
-        <NotFound>
-            <LayoutView Layout="@typeof(MainLayout)">
-                <p>Sorry, there's nothing at this address.</p>
-            </LayoutView>
-        </NotFound>
-    </Router>
-</CascadingAuthenticationState>
-
 @code {
     [Parameter]
     public InitialApplicationState InitialState { get; set; }

From 1c132d01f30cdb618c09891b816b5eb9f4adbde5 Mon Sep 17 00:00:00 2001
From: Luke Latham <1622880+guardrex@users.noreply.github.com>
Date: Thu, 23 Apr 2020 15:37:00 -0500
Subject: [PATCH 5/8] Updates

---
 .../authentication/scaffold-identity.md       | 63 +++++--------------
 1 file changed, 17 insertions(+), 46 deletions(-)

diff --git a/aspnetcore/security/authentication/scaffold-identity.md b/aspnetcore/security/authentication/scaffold-identity.md
index b4e5dc682a48..9d0839004031 100644
--- a/aspnetcore/security/authentication/scaffold-identity.md
+++ b/aspnetcore/security/authentication/scaffold-identity.md
@@ -176,6 +176,10 @@ For more information, see <xref:security/blazor/server#pass-tokens-to-a-blazor-s
 In the *Pages/_Host.cshtml* file, establish the token after adding it to the `InitialApplicationState` and `TokenProvider` classes:
 
 ```csharp
+@inject Microsoft.AspNetCore.Antiforgery.IAntiforgery Xsrf
+
+...
+
 var tokens = new InitialApplicationState
 {
     ...
@@ -184,6 +188,16 @@ var tokens = new InitialApplicationState
 };
 ```
 
+Update the `App` component (*App.razor*) to assign the `InitialState.XsrfToken`:
+
+```csharp
+@inject TokenProvider TokensProvider
+
+...
+
+TokensProvider.XsrfToken = InitialState.XsrfToken;
+```
+
 The `TokenProvider` service demonstrated in the topic is used in the `LoginDisplay` component in the following [Layout and authentication flow changes](#layout-and-authentication-flow-changes) section.
 
 ### Enable authentication
@@ -210,7 +224,7 @@ Add a `RedirectToLogin` component (*RedirectToLogin.razor*) to the app's *Shared
     protected override void OnInitialized()
     {
         Navigation.NavigateTo("Identity/Account/Login?returnUrl=" +
-            Navigation.ToBaseRelativePath(Navigation.Uri), true);
+            Uri.EscapeDataString(Navigation.Uri), true);
     }
 }
 ```
@@ -220,7 +234,7 @@ Add a `LoginDisplay` component (*LoginDisplay.razor*) to the app's *Shared* fold
 ```razor
 @using Microsoft.AspNetCore.Components.Authorization
 @inject NavigationManager Navigation
-@inject TokenProvider TokenProvider
+@inject TokenProvider TokensProvider
 
 <AuthorizeView>
     <Authorized>
@@ -230,7 +244,7 @@ Add a `LoginDisplay` component (*LoginDisplay.razor*) to the app's *Shared* fold
         <form action="/Identity/Account/Logout?returnUrl=%2F" method="post">
             <button class="nav-link btn btn-link" type="submit">Logout</button>
             <input name="__RequestVerificationToken" type="hidden" 
-                value="@TokenProvider.XsrfToken">
+                value="@TokensProvider.XsrfToken">
         </form>
     </Authorized>
     <NotAuthorized>
@@ -249,49 +263,6 @@ In the `MainLayout` component (*Shared/MainLayout.razor*), add the `LoginDisplay
 </div>
 ```
 
-In the `App` component (*App.razor*):
-
-* Wrap the `Router` component with the `CascadingAuthenticationState` component.
-* Add the `RedirectToLogin` component for unauthorized routes.
-
-The following shows the complete component if the app is also using the [TokenProvider service](xref:security/blazor/server#pass-tokens-to-a-blazor-server-app):
-
-```razor
-@inject TokenProvider TokenProvider
-
-<CascadingAuthenticationState>
-    <Router AppAssembly="@typeof(Program).Assembly">
-        <Found Context="routeData">
-            <AuthorizeRouteView RouteData="@routeData"
-                                DefaultLayout="@typeof(MainLayout)">
-                <NotAuthorized>
-                    <RedirectToLogin />
-                </NotAuthorized>
-            </AuthorizeRouteView>
-        </Found>
-        <NotFound>
-            <LayoutView Layout="@typeof(MainLayout)">
-                <p>Sorry, there's nothing at this address.</p>
-            </LayoutView>
-        </NotFound>
-    </Router>
-</CascadingAuthenticationState>
-
-@code {
-    [Parameter]
-    public InitialApplicationState InitialState { get; set; }
-
-    protected override Task OnInitializedAsync()
-    {
-        TokenProvider.AccessToken = InitialState.AccessToken;
-        TokenProvider.RefreshToken = InitialState.RefreshToken;
-        TokenProvider.XsrfToken = InitialState.XsrfToken;
-
-        return base.OnInitializedAsync();
-    }
-}
-```
-
 ### Style authentication endpoints
 
 Because Blazor Server uses Razor Pages Identity pages, the styling of the UI changes when a visitor navigates between Identity pages and components. You have two options to address the incongruous styles:

From ea9c3837992e71e2d1d81e578a273deb099c899e Mon Sep 17 00:00:00 2001
From: Luke Latham <1622880+guardrex@users.noreply.github.com>
Date: Mon, 27 Apr 2020 09:06:18 -0500
Subject: [PATCH 6/8] TokensProvider (plural) -> TokenProvider (singular)

---
 aspnetcore/security/authentication/scaffold-identity.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/aspnetcore/security/authentication/scaffold-identity.md b/aspnetcore/security/authentication/scaffold-identity.md
index 9d0839004031..e1a448d5111c 100644
--- a/aspnetcore/security/authentication/scaffold-identity.md
+++ b/aspnetcore/security/authentication/scaffold-identity.md
@@ -191,11 +191,11 @@ var tokens = new InitialApplicationState
 Update the `App` component (*App.razor*) to assign the `InitialState.XsrfToken`:
 
 ```csharp
-@inject TokenProvider TokensProvider
+@inject TokenProvider TokenProvider
 
 ...
 
-TokensProvider.XsrfToken = InitialState.XsrfToken;
+TokenProvider.XsrfToken = InitialState.XsrfToken;
 ```
 
 The `TokenProvider` service demonstrated in the topic is used in the `LoginDisplay` component in the following [Layout and authentication flow changes](#layout-and-authentication-flow-changes) section.
@@ -234,7 +234,7 @@ Add a `LoginDisplay` component (*LoginDisplay.razor*) to the app's *Shared* fold
 ```razor
 @using Microsoft.AspNetCore.Components.Authorization
 @inject NavigationManager Navigation
-@inject TokenProvider TokensProvider
+@inject TokenProvider TokenProvider
 
 <AuthorizeView>
     <Authorized>
@@ -244,7 +244,7 @@ Add a `LoginDisplay` component (*LoginDisplay.razor*) to the app's *Shared* fold
         <form action="/Identity/Account/Logout?returnUrl=%2F" method="post">
             <button class="nav-link btn btn-link" type="submit">Logout</button>
             <input name="__RequestVerificationToken" type="hidden" 
-                value="@TokensProvider.XsrfToken">
+                value="@TokenProvider.XsrfToken">
         </form>
     </Authorized>
     <NotAuthorized>

From 56bae143295dc7589ad8c16a804ea7e790c3693d Mon Sep 17 00:00:00 2001
From: Luke Latham <1622880+guardrex@users.noreply.github.com>
Date: Tue, 28 Apr 2020 07:17:38 -0500
Subject: [PATCH 7/8] Add scaffolding cross-links

---
 aspnetcore/security/blazor/server/index.md | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/aspnetcore/security/blazor/server/index.md b/aspnetcore/security/blazor/server/index.md
index ac25f0ac24fa..3914180ca907 100644
--- a/aspnetcore/security/blazor/server/index.md
+++ b/aspnetcore/security/blazor/server/index.md
@@ -5,7 +5,7 @@ description: Learn how to secure Blazor Server apps as ASP.NET Core applications
 monikerRange: '>= aspnetcore-3.1'
 ms.author: riande
 ms.custom: mvc
-ms.date: 04/27/2020
+ms.date: 04/28/2020
 no-loc: [Blazor, SignalR]
 uid: security/blazor/server/index
 ---
@@ -93,3 +93,10 @@ Using the `-o|--output` option, the command uses the value provided for the `{AP
 For more information, see the [dotnet new](/dotnet/core/tools/dotnet-new) command in the .NET Core Guide.
 
 ---
+
+## Scaffold Identity
+
+Scaffold Identity into a Blazor Server project:
+
+* [Without existing authorization](xref:security/authentication/scaffold-identity#scaffold-identity-into-a-blazor-server-project-without-existing-authorization).
+* [With authorization](xref:security/authentication/scaffold-identity#scaffold-identity-into-a-blazor-server-project-with-authorization).

From 4046f6d43c4c52681bd94bb6d062e69dbfb0e573 Mon Sep 17 00:00:00 2001
From: Luke Latham <1622880+guardrex@users.noreply.github.com>
Date: Fri, 15 May 2020 08:14:43 -0500
Subject: [PATCH 8/8] Link update

---
 aspnetcore/security/authentication/scaffold-identity.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/aspnetcore/security/authentication/scaffold-identity.md b/aspnetcore/security/authentication/scaffold-identity.md
index 0b67f6b9fa09..dfbcb9bb9afb 100644
--- a/aspnetcore/security/authentication/scaffold-identity.md
+++ b/aspnetcore/security/authentication/scaffold-identity.md
@@ -184,7 +184,7 @@ Tokens can be passed to components:
 * When authentication tokens are provisioned and saved to the authentication cookie, they can be passed to components.
 * Razor components can't use `HttpContext` directly, so there's no way to obtain an [anti-request forgery (XSRF) token](xref:security/anti-request-forgery) to POST to Identity's logout endpoint at `/Identity/Account/Logout`. An XSRF token can be passed to components.
 
-For more information, see <xref:security/blazor/server#pass-tokens-to-a-blazor-server-app>.
+For more information, see <xref:security/blazor/server/index#pass-tokens-to-a-blazor-server-app>.
 
 In the *Pages/_Host.cshtml* file, establish the token after adding it to the `InitialApplicationState` and `TokenProvider` classes:
 
@@ -218,7 +218,7 @@ The `TokenProvider` service demonstrated in the topic is used in the `LoginDispl
 In the `Startup` class:
 
 * Confirm that Razor Pages services are added in `Startup.ConfigureServices`.
-* If using the [TokenProvider](xref:security/blazor/server#pass-tokens-to-a-blazor-server-app), register the service.
+* If using the [TokenProvider](xref:security/blazor/server/index#pass-tokens-to-a-blazor-server-app), register the service.
 * Call `UseDatabaseErrorPage` on the application builder in `Startup.Configure` for the Development environment.
 * Call `UseAuthentication` and `UseAuthorization` after `UseRouting`.
 * Add an endpoint for Razor Pages.
@@ -242,7 +242,7 @@ Add a `RedirectToLogin` component (*RedirectToLogin.razor*) to the app's *Shared
 }
 ```
 
-Add a `LoginDisplay` component (*LoginDisplay.razor*) to the app's *Shared* folder. The [TokenProvider service](xref:security/blazor/server#pass-tokens-to-a-blazor-server-app) provides the XSRF token for the HTML form that POSTs to Identity's logout endpoint:
+Add a `LoginDisplay` component (*LoginDisplay.razor*) to the app's *Shared* folder. The [TokenProvider service](xref:security/blazor/server/index#pass-tokens-to-a-blazor-server-app) provides the XSRF token for the HTML form that POSTs to Identity's logout endpoint:
 
 ```razor
 @using Microsoft.AspNetCore.Components.Authorization